AI agent reverse engineering exposes new firmware decryption risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Bishop Fox's blog post: Claude Code reproduced a senior researcher's SonicWall firmware decryption workflow by tracing proprietary SWI encryption through Vault and RSA key recovery.

Why it matters: This matters because AI agents are already capable of chaining decompilation, key discovery, and cryptographic reasoning, which changes how teams should think about firmware secrecy, research workflows, and the exposure created when appliance internals are accessible to tooling.

Context

Firmware encryption is often meant to slow inspection, delay vulnerability discovery, and protect vendor internals, but it does not remove the underlying attack surface when the decrypt path is embedded in the appliance itself. In this case the important security question is not whether the image is encrypted, but whether the decryption workflow can be reconstructed from files, binaries, and shipped management logic.

The identity angle is indirect but real: the decryption path depended on a Vault instance, embedded Shamir shares, and an RSA private key that behaved like high-value machine credentials inside the appliance. Once those elements are exposed to an AI agent with decompiler access, the problem becomes one of machine secret governance as much as reverse engineering.

The setup was a reproduction exercise, not an original break of unknown firmware. That makes the result easier than a live offensive discovery, but it is still a strong indicator of how much of this work can now be delegated to an AI workflow.

Key questions

Q: What breaks when firmware decryption relies on hidden key handling inside the appliance?

A: When key handling is buried inside the appliance, reverse engineering becomes dependent on finding a working runtime environment or a decrypted image first. That creates a chicken-and-egg problem. Without access to the key unwrap routine, analysts cannot validate the password, decrypt the body, or inspect the filesystem, which delays both research and incident review.

Q: Why do embedded Vault stores and Shamir shares create a firmware governance risk?

A: They collapse separation between the thing being protected and the mechanism that protects it. If the appliance contains its own recovery material, an analyst can often reproduce the vendor’s trust chain instead of defeating the cryptography. That is a governance problem because the product image becomes both the asset and the secret store, which weakens the boundary security teams assume exists.

Q: How do security teams know if AI-assisted reverse engineering is becoming a risk in their environment?

A: Look for unmonitored access to decompilers, sandbox images, firmware copies, recovery material, and MCP-connected tooling. If those resources are broadly available, an AI agent can assemble a decryption path or exposure map even when no single source looks dangerous on its own. The signal is tool breadth plus sensitive artefact proximity.

Q: What should teams do when an agent gets stuck on a cryptographic detail?

A: Do not assume the model has failed in a terminal way. Insert a human checkpoint to test alternate hypotheses, such as a different padding mode, hash choice, or key derivation path, and then resume the workflow with the new constraint. That keeps the agent productive without letting it burn time inside a false branch.

Technical breakdown

How AI agents follow a firmware decryption chain

Firmware decryption is rarely one step. In this case the agent had to identify a container format, infer that a base64 blob was an encrypted RSA payload, and connect that payload to the code path that performed the actual decryption. That required correlating bytes, binaries, and filesystem artifacts rather than relying on a single obvious secret. The important technical point is that agentic tooling can now move across those layers with enough persistence to reconstruct the chain even when the vendor did not document it. That does not make the agent autonomous in a governance sense, but it does make it capable of executing a multi-stage analysis pipeline that used to demand a human specialist.

Practical implication: Treat decompiler-connected agents as capable of multi-stage secret discovery, not just code summarisation.

Why Vault and embedded Shamir shares changed the problem

The key discovery was not the firmware image itself but a Vault instance shipped on the appliance, with the master key reconstructed from embedded Shamir secret shares. Shamir’s Secret Sharing splits a secret into thresholds, so the presence of enough plaintext shares inside a trusted environment collapses the protection model. Once the agent found the shares and the Vault binary, it no longer needed to brute force the secret storage. It could reproduce the vendor’s own key management path and recover the RSA key. This is a machine identity governance issue because the decryption workflow depended on secrets, tokens, and service-side trust embedded in the product image.

Practical implication: Inventory embedded secret-management systems inside appliances and test whether shipped shares or tokens collapse the trust boundary.

Why judgment remains the bottleneck even when skill is automated

The agent succeeded on the technical path, but it still stalled on a padding detail until a human asked the right question. That distinction matters. AI agents can now execute the long middle of a reverse-engineering task, but they still depend on supervisory intervention when the search space narrows or the wrong hypothesis is reinforced by confidence. The risk for security teams is not that humans disappear from the loop. It is that teams underestimate how much specialised analysis an agent can complete before a human even notices the work has begun. In practice, that pushes review and containment earlier in the workflow.

Practical implication: Build checkpoints for hypothesis shifts, not just final review, when agents handle sensitive reverse-engineering tasks.

Threat narrative

Attacker objective: The objective is to recover firmware contents and the embedded secrets or logic that protect them, enabling deeper inspection of appliance internals.

1. Entry begins when the agent receives an encrypted SonicWall firmware image and a decrypted filesystem from a related appliance version, giving it enough material to trace the decryption path.
2. Credential access occurs when it identifies a Vault instance on the appliance, reconstructs the master key from embedded Shamir secret shares, and extracts the RSA private key used in the workflow.
3. Impact follows when the recovered RSA key decrypts the SWI payload and reveals the firmware contents, reproducing a senior researcher’s manual result at machine speed.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic reverse engineering has moved firmware secrecy from a human-only problem to a supervised machine workflow. The important shift is not that the model found a bug, but that it reconstructed a protected software path from binary evidence, filesystem artefacts, and cryptographic structure. That means vendor assumptions about the cost of unpacking firmware are weakening faster than many teams expect. Practitioners should assume AI-assisted analysis can now shorten the time from artifact access to decrypted contents.

Shipped machine secrets are the real governance failure when an appliance embeds its own trust root. Once a product ships Vault data, secret shares, and a recoverable private key inside the same trust boundary, the protection model depends on obscurity and product configuration rather than separation of duties. That is a fragile model for any environment that treats firmware images as sensitive assets. Practitioners should inspect whether shipped secret material can be reconstructed from the product itself.

Firmware encryption no longer guarantees research friction when the decrypt path is recoverable from the appliance. The meaningful control question is whether decryption depends on isolated, externally held trust or on artefacts distributed with the image. If the latter is true, the effective control is weak even before an attacker or researcher begins. Practitioners should review appliance packaging for recoverable credentials, key stores, and internal management services.

Human supervision is becoming the governance layer for AI research work, not just a quality check. The model was able to do the technical heavy lifting, but it still needed direction at inflection points such as cryptographic dead ends. That creates a new operating model where expertise is distributed between machine execution and human judgment. Practitioners should design review points around hypothesis changes and sensitive secret-handling steps, not only final outputs.

From our research library:

• Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

AI-assisted reverse engineering is now good enough to compress tasks that once depended on senior human persistence. For practitioners, that means appliance secrecy, binary obfuscation, and embedded key stores should no longer be treated as slow-moving controls. Once a model can reason over files, decompiled code, and secret material in one loop, the relevant question becomes where the trust boundary actually lives.

Machine-secret governance now matters in firmware packaging and not just in cloud operations. If the image itself contains the artefacts needed to reconstruct the decrypt path, then the security model has already shifted from secrecy to recoverability. Teams should expect AI tooling to accelerate that discovery path and should review whether their vendors ship recoverable trust roots inside products.

For practitioners

• Audit appliance images for embedded trust roots Review firmware and virtual appliance packages for shipped secret stores, recovery shares, and internal management services that can be reconstructed from the image itself.
• Restrict agent access to decompiler workflows Limit which AI agents can inspect binaries, file systems, and secret-management artefacts, especially in environments that contain vendor or customer credentials.
• Test whether encrypted firmware depends on recoverable internals Validate whether the decrypt path requires an external secret boundary or whether the appliance ships enough information to regenerate the key path locally.
• Add supervision checkpoints for cryptographic dead ends Require human review when an agent reaches repeated failures in padding, key derivation, or secret reconstruction, because that is where false confidence tends to persist.
• Separate research tooling from production secret material Keep reverse-engineering sandboxes away from real Vault instances, production key stores, and any credential material that could be repurposed during analysis.

Key takeaways

• The article shows that AI agents can reproduce a senior researcher’s firmware decryption workflow when given enough artefacts and minimal direction.
• The risk is not just faster analysis, but faster discovery of embedded trust material such as Vault data, Shamir shares, and private keys.
• Security teams should treat recoverable secrets inside appliances as a governance failure, because encryption alone does not protect what ships with the image.

Key terms

• Firmware Decryption Path: The chain of files, keys, parameters, and runtime logic required to unlock a protected firmware image. Security teams should treat the path as an asset in its own right, because exposure of the path can be as damaging as exposure of the image content.
• Shamir Secret Sharing: Shamir Secret Sharing is a threshold cryptography method that splits a secret into multiple parts so that only a defined minimum number can reconstruct it. In account recovery, it lets several recovery contacts collaborate without any single person holding the full passphrase or key material.
• Vault-Bound Key Material: Key material stored or recovered through a HashiCorp Vault instance rather than directly in the protected file. In this article, the important risk is not the Vault product itself but the fact that the appliance shipped enough information for the decryption chain to be rebuilt locally.
• Agentic Reverse Engineering: The use of an AI agent to explore binaries, filesystems, and tooling in a goal-driven way. Unlike a simple assistant, the agent can sequence actions, interpret intermediate results, and change approach during analysis, which makes it useful for security research and also risky when exposed to sensitive artefacts.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader access and lifecycle risks that modern infrastructure creates.