Notifications
Clear all
Topic starter
06/09/2026 9:34 am
TL;DR: App attacks surged to 83% in January 2025 from 65% a year earlier, according to Arxan Technologies, while LLMs are compressing the skills and time needed to reverse engineer client-side apps, extract endpoints, and move toward backend abuse. The defensive priority is now faster hardening, runtime detection, and response that can outpace AI-assisted exploitation.
NHIMG editorial — based on content published by Arxan Technologies: Fight Fire with Fire: Using AI to Fight AI
By the numbers:
- App attacks surged to 83% in January 2025, up from 65% just a year earlier.
- The attack rate climbed from 65% to 83% in a single year, showing how quickly application threat pressure is rising.
Questions worth separating out
Q: How should teams handle client-side applications that expose valid API credentials?
A: Treat exposed client-side credentials as a trust boundary failure, not just a secret leak.
Q: Why do LLM-assisted client-side attacks create higher risk than manual reverse engineering?
A: LLMs reduce the expertise and time required to analyse binaries, script dynamic instrumentation, and identify backend paths.
Q: What breaks when runtime protections are added too late in the release cycle?
A: The protection gap becomes the vulnerability.
Practitioner guidance
- Shorten the protection blueprint cycle Measure the time from source code availability to hardened release and cut it aggressively.
- Instrument runtime tamper detection Detect unpacking, instrumentation, code modification, and compromised execution environments directly in the app.
- Assume client-side secrets will be recovered Treat API keys, tokens, and embedded endpoints as discoverable inputs, not protected assets.
What's in the full article
Arxan Technologies' full blog covers the operational detail this post intentionally leaves for the source:
- The technical walkthrough of reverse engineering a mobile app binary with an LLM and dynamic instrumentation tools.
- The protection blueprint workflow and how AI reduces the time needed to harden a specific app.
- The runtime reaction examples, including forced step-up authentication and app shutdown conditions.
- The threat research context behind the 2025 application security attack-rate trend.
👉 Read Arxan Technologies' analysis of AI-assisted client-side app attacks and runtime defence →
AI-assisted client-side attacks: are your app controls keeping up?
Explore further
06/09/2026 9:34 am
AI-assisted client-side attack compression is now a governance problem, not just a tooling problem. The article’s central point is that attacker skill is no longer the primary constraint when LLMs can guide reverse engineering, scripting, and endpoint discovery. That changes the control objective from spotting advanced operators to reducing the time and exposure of every client-side release. For appsec teams, the practical conclusion is that hardening must move at the pace of automated analysis, not the pace of manual review.
A question worth separating out:
Q: How should security teams respond when client-side app traffic looks legitimate?
A: Do not rely on network legitimacy alone. Join runtime signals, identity context, and request behaviour so valid credentials used from an unpacked client can still be flagged. The right response is to verify execution context, constrain access paths, and trigger in-app controls when behaviour diverges from expectations.
👉 Read our full editorial: AI-assisted client-side attacks are shrinking app defense margins
