Fast, cheap AI-assisted decompilation of binary code is here. Which means code secrecy is dead.
Decompilers in themselves are not a new technology. Security researchers have employed them for years to analyze compiled malware. There’s been some limited use by others, notably by hobbyists decompiling abandonware games. But there were a couple of issues that prevented this from becoming common practice.
One is simply that running decompilers was difficult. It wasn’t as simple as feed in binary, get out source; it needed a person with specialist skills prepared to do spelunking through wildernesses of machine code and object formats. The other problem was that decompilation didn’t give you anything like the explanatory comments that had been in the original code, so you could easily wind up with code that you could read without being able to understand or modify it.
Now large language models are busily smashing both of those barriers flat. They’re better at the kind of detail analysis required to run the human side of a decompilation than humans are. More importantly, in the process of decompiling code, they rather automatically build a global model of how it works that can easily be expressed by high quality comments in the extracted code. All you have to do, basically, is ask for the comments.
I’m going to reinforce that latter point because it may not be obvious how good LLMs are at this, and how much better they’re going to get. When they decompile code and comment it for you, they’re not just working from that one piece of code you have put in front of them — they’ll have in their training set hundreds, possibly thousands of pieces of code similar to it and with comments. This will give them superhuman levels of insight not just into what it does at the microlevel, but what it means to the humans who wrote it, and what technical assumptions it’s embodying.
Compilation no longer guards your secrets. Or, to put it more precisely the expected time span in which you can still count on it to obscure them is measured in months. Possibly weeks.
What does this mean?
It means you’re in an open-source world now. All it’s going to take for anybody to bust your proprietary IP open is care enough to spend tokens on the analysis.
You will maximize your chances of survival as a software business if you get out ahead of this rather than trying to fight it.
This isn’t exactly the way I expected open source to win. But, you know, I’ll take it. Good enough.
ESR, The social media site formerly known as Twitter, 2026-04-08.
July 12, 2026
QotD: “This isn’t exactly the way I expected open source to win”
No Comments »
No comments yet.
RSS feed for comments on this post. TrackBack URL
