/AI-TOOLS · 2026-09-02
The model is a router, not IDA
Paste a function. Assign a lane. If the agent picks jadx on an ELF, you have a guess.
AI-on-the-desk is a router with a scope gate, then a small window of text, then a human. The models we actually run are listed on /models. How we score them is four numbers.
What we paste
- A function the static pass already isolated.
- A calling convention question.
- A diff of two confirmed layouts.
- A protocol snippet we already extracted, not the whole PCAP.
What we do not paste: the customer’s firmware into a consumer chatbot. Samples stay in the tenant. If the model vendor is Bedrock, that is because the tenant required in-region, not because Grok was “worse at ARM.”
What the model is good at
Naming a plausible struct from a confirmed access pattern. Drafting a parser in Python once offsets are known. Summarizing a 200-line decompiler dump you already trust. Routing: APK → jadx skill, ELF → Ghidra skill, “this looks packed” → stop and say packed.
What it is bad at
Being Hex-Rays. Inventing xrefs it did not see. Declaring a vulnerability from a screenshot. Completing a CTF when the harness will not open the file. If you want a leaderboard, use someone else’s. Ours stays empty where we did not measure.
Opus 5 on owned samples. Fable 5.1 if the prompt stays on Fable. gpt-daybreak-blue for verified-defender malware triage, not general Sol. Grok 4.6 only behind the same harness. Details: six models.
The router, in one picture
scope file exists? no → refuse
file(1) / apk / elf / blob
APK → jadx + native .so desk
ELF → Ghidra/IDA, then Unicorn
bin → unblob first
model sees the slice, not the image
human owns the finding
That router is a skill we run locally — reverse-skill. If your “AI RE tool” cannot refuse, it is autocomplete with liability.