Using AI to reverse engineer hardware

What happened when researchers used AI to reverse engineer hardware?

In August 2026, an independent researcher reported that AI assistance exposed weak firmware protection in five consumer peripherals: a webcam, monitor, microphone, capture card and smart light. The work took about 13 hours of AI processing and 98 human prompts. This comes from a single secondary write-up, so treat the details as unverified until checked against the original research.

Two findings stand out. A popular USB microphone had a hidden plaintext command shell, and a webcam's recording LED could reportedly be bypassed. Even the one device with signed firmware (Ed25519) was still compromised, through an HTTP exploit. The write-up also notes that operating systems currently cannot verify peripheral integrity.

Is AI actually good at reverse engineering?

It is good enough to change the economics, but not reliable enough to trust unsupervised. Reverse engineering used to demand scarce specialist time. AI cuts that cost sharply for static analysis, though it still needs a human to check its work.

On SRE-Bench (19 private programs, 262 binary instances, 44 anti-analysis techniques), the original paper had GPT-5.6 Sol fully solving 31.5% of instances and Claude Fable 5.1 fully solving 26.9%. OpenAI later reported 88.0% for GPT-6 Astra, but that figure is secondhand and came from evaluations without production safeguards. Treat it as a direction of travel, not a measured fact.

A 2025 Kennesaw State University study paired GhidraMCP with Claude Sonnet 4 on pseudo-ransomware samples. It found the workflow faster and clearer than manual analysis, but the setup could not do dynamic analysis or binary patching, and it sometimes produced inaccurate annotations. The authors stress human oversight.

Why does this matter for a small business or online founder?

Because the assumption that obscure code is safe code is now weak. If your product, website or workflow depends on a secret hidden inside client-side code, a binary or a device, a motivated person with an AI assistant can probably inspect it far more cheaply than before.

That affects more than hardware makers. Think about API keys pasted into front-end code, pricing logic in browser scripts, and licence checks in desktop tools. Think also about the webcams, microphones and smart lights sitting on your team's desks. Most owners never consider these as part of their attack surface.

Limits remain, and they are worth stating. Models invent plausible explanations, lose coherence on long multi-stage projects and struggle with obfuscation. One benchmark run (MirrorCode) cost roughly $2,600 over 19 days. Large jobs are not free, so a random small business is not the likeliest target. A well-known one, or one holding valuable data, is.

What should I do about the devices in my business?

Start with a short inventory, then reduce risk where it is cheapest. You do not need a security team. You need to know what is plugged in, who updates it, and what it can access.

1. List your peripherals. Webcams, microphones, capture cards, monitors with USB hubs and smart lights all count.
2. Prefer vendors that sign firmware and publish update notes. Signing alone is not a guarantee, as the Ed25519 case shows, but it raises the bar.
3. Keep accessories updated. Check for firmware updates quarterly.
4. Be cautious with WebUSB, WebHID and WebBluetooth permissions. Only grant them to sites you fully trust.
5. Cover or unplug cameras and microphones on machines used for sensitive calls, rather than relying on an indicator light.

Is it legal to reverse engineer hardware or software?

It depends on your jurisdiction, your purpose and the licence terms. Rules vary, and licence agreements often prohibit it outright. Check your legal position before you start, and take professional advice if the work touches a product you do not own.

Confidentiality is the second trap. Uploading a proprietary binary or firmware image to a hosted AI tool means sharing it with a third party. Consider your contracts and your clients' data before you paste anything in.

What is Braynex Services' view?

At Braynex Services, we think the lesson is bigger than gadgets: secrecy is a poor moat. The cited defences are secure boot chains, runtime integrity monitoring and authenticated hardware interfaces, and value is shifting towards data, services and operational know-how. That is where small businesses should invest.

It echoes what we see with rented platforms. A nail salon we worked with was paying Fresha about 1,800 a month in commission and moved to its own booking system at 35 a month, saving roughly 21,000 a year. The advantage was never a clever hidden trick. It was owning the customer relationship, the data and the process.

So assume your code, scripts and devices can be inspected. Keep secrets on the server, not in the browser. Build advantage in service quality, follow-up and your own customer data, which no one can reverse engineer from a binary.

Want help checking where you are exposed?

Braynex Services offers a free audit of your website, booking and customer systems, covering exposed code, rented platform risks and the places money quietly leaks. Book yours at braynexservices.com.