A Sun Yat-sen undergrad built BLA to blind AI reverse-engineering agents and inflate their token bills up to 2,800x

A software engineering undergraduate in China has open-sourced a tool aimed squarely at the wave of AI reverse-engineering agents. Called BLA, it is an MCP service and CLI utility whose stated goal, as reported by QbitAI, is to make those agents blind.

The backdrop is another project, REA, which bills itself as AI that reverse-engineers anything. REA passed 100,000 GitHub stars within a week of appearing, prompting some developers to treat it as a signal that software is dead, and it is often listed among 2026's most dangerous open-source projects. BLA is a hardening scheme built against tools like it.

BLA works in three steps: poisoning, budget exhaustion and induced misjudgment. First it plants convincing fake credentials, fake diagnostics, code branches that look like authorization logic, and decoy source maps, including a well-formed map pointing at invented file paths and snippets so that ordinary client code appears to call into a hardware security zone. An agent that treats this as evidence will follow a call chain that does not exist.

The second step is blunter: precisely tripping the analyzer's hardcoded quotas so the tool errors out. In Electron's .asar format, BLA's strongest setting inserts roughly 4,000 decoy files with very short contents and very long paths, pushing the bulk of the size into the header index. In the author's test, a 607-byte package became 16.93 MiB after hardening, and the header exceeded REA's default limit, so reads failed outright.

The author reports both measurements and estimates. Across 13 before-and-after comparisons, seven errored or were rejected at the tested step, two returned partial results, one failed only on a specific query, and three showed no observed disruption. On cost, internal tests put token consumption for reversing hardened software at roughly 300 to 2,800 times the original; across 14 examples in the repository, total tokens came to about 639.5 times and total cost about 304.4 times the baseline.

The main author, Timo Zhang, is a third-year software engineering student at Sun Yat-sen University, currently interning at ByteDance and a contributor to LobeHub. His other project, mu, a small Raspberry Pi-based model that reduces token use for coding agents, points in the opposite direction.

BLA now has more than 3,900 stars and 476 forks. It illustrates an adversarial surface that is only just forming: when AI agents can cheaply take apart binaries and front-end bundles, software protection shifts from obfuscation and packing toward poisoning the agent's evidence chain and raising its inference bill.

The protection is not absolute. The author notes that analyzer quota limits can be raised, and that stuffing thousands of decoys makes the package much larger, which is itself a detectable signal. For defenders, BLA raises the price of an attack rather than building a wall, which makes the next question whether AI reverse-engineering tools will train specifically against this kind of poisoning.