WE HID BACKDOORS IN BINARIES — OPUS 4.6 FOUND 49% OF THEM

Summary from the TLDR InfoSec newsletter

BinaryAudit is an open-source benchmark from Quesma for evaluating AI agents' ability to detect backdoors in stripped binary executables using reverse engineering tools like Ghidra and Radare2. The benchmark tests models against backdoored versions of lighttpd, dnsmasq, Dropbear, and Sozu, with Claude Opus 4.6 leading at 49% detection but hampered by a 22% false positive rate across clean binaries. Results highlight that while AI-assisted binary analysis is becoming accessible to non-specialists, high false positive rates and inability to trace data flow through complex binaries make it unsuitable for production malware detection today.