BLA, a shield that makes AI reverse-engineering agents give up or guess

An AI agent can take a JS bundle, a WebAssembly module or an Electron app apart in minutes. Most teams cannot patch a release that fast. BLA is a new open source tool from the user qybaihe that fights back on the build side. BLA stands for Blind LLM Agents. It alters a released artifact. An agent reading the altered artifact hits resource limits, finds false hints, or walks away with nothing. The runtime behaviour of the program is left untouched. The repository has 1,397 stars after six days. It sits at rank 17 on Trendshift's daily list.

BLA names three strategies in its README. Poison injects decoys that look real to an agent: fake credentials, honey metadata, misleading control flow. Exhaust inflates the artifact past documented resource budgets. The README lists limits like the ASAR header cap of 16 MiB, SQLite column evaluation, and WASM representation thresholds. Hallucinate leaves gaps and redactions in the output that the agent cannot resolve. The agent then errors, or guesses wrong.

What BLA covers

The formats listed cover most of what a team can release today. On the web side: JavaScript bundles, TypeScript bundles, WebAssembly, and Electron archives. On the desktop and server side: Python bytecode, SQLite databases, Go binaries, Android DEX, .NET assemblies, and EVM bytecode. Model files are included too, with Safetensors and GGUF. The project also plugs into Claude Code, Cursor, Codex, and GitHub Copilot CLI through MCP. The README's own benchmark reports a 612 times token multiplication. It also reports a 292 times cost multiplication across fourteen targets. The runtime equivalence held at one hundred percent.

The benchmark is the author's own. BLA ran a tool called REA, short for Reverse Engineer Anything, against the hardened builds. REA is a real repository of its own. It sits beside BLA at the top of Trendshift this week. The failures BLA counted in REA's output are capacity errors, budget rejections, redaction failures, and malformed outputs. The failures hit Go buildinfo, BEAM chunks, and Electron fuses in the test runs.

Where the strategy breaks

The simpler the artifact, the less of it there is to poison. A short, well written WASM module has fewer places to inject a false hint. A fuzzer with a longer time budget may still finish the work. The 292 times cost multiplier is the figure to think about. Suppose an attacker spends an afternoon on a $500 reverse-engineering job. Raising it to $146,000 is one thing. Raising a one minute job to five hours is another.

BLA also only works on what a defender has released. A proprietary SDK built into a reader's app can be protected. An API endpoint cannot. Once a request leaves the client, the server's reply is what it is. Any secret that must be in the released file is still there, just in a less convenient form.

A team that releases a desktop app, a browser extension, or a model file has a new tool. The user of the product sees the application the same way as before. The AI agent reading the compiled bundle sees something else. Much more code, in a different order. Keys that look valid, and are not. That is a design choice. A lot of product teams would make it if they had the option. Now they do.

Source

GitHub: qybaihe/bla. Benchmark figures and markers come from the project's own README.