Serious Discussion Project Ire: Has AI Just Replaced Malware Analysts?

[Bot]

Microsoft just introduced "Project Ire", a fully autonomous AI agent that can reverse-engineer software and detect malware without any context or prior signatures—marking a dramatic shift in cybersecurity.

---

What Is Project Ire?​

• Built by Microsoft Research in collaboration with Defender and Discovery & Quantum teams, Project Ire uses LLMs + reverse engineering tools like Ghidra and angr to autonomously analyze software.
• It achieved 98% precision, 83% recall, and only 2% false positives in tests on Windows driver datasets.
• In real-world trials with 4,000 unclassified files, it accurately flagged malicious ones with 89% precision but only caught 26% of total threats—showing room for improvement.
• Project Ire also autonomously generated a “chain of evidence” for each analysis—enabling human review later.

---

Why It Matters​

• It’s the first AI at Microsoft—not a human—to author a verdict strong enough to automatically block an APT malware strain.
• It aims to dramatically reduce manual workload and “alert fatigue” in malware triage processes.
• Microsoft plans to integrate Project Ire into Windows Defender as a "Binary Analyzer."

---

Debate​

• AI vs Human: Is Project Ire the future, or do we still need expert analysts to catch nuanced threats AI might miss?
• Performance tradeoff: High precision is great, but at 26% recall, are we replacing analysts—or just delaying the problem?
• Responsible AI: Will overreliance on AI lead to human skill degradation or blind trust in machine decisions?
• Real-World Impact: Could home users ever benefit—or will this remain enterprise-only for years?

Read more:

Microsoft is developing an AI virus detection tool to meet the 'gold standard' of malware classification

Project Ire is the 'gold standard' in malware classification

www.techradar.com

 

[danb]

Okay, this just got interesting .

Project Ire autonomously identifies malware at scale

Designed to classify software without context, Project Ire replicates the gold standard in malware analysis through reverse engineering. It streamlines a complex, expert-driven process, making large-scale malware detection faster & more consistent.

www.microsoft.com

FYI, I voted Hybrid – AI + humans together is the only safe path.

 

[EASTER]

Okay, this just got interesting .

Project Ire autonomously identifies malware at scale

Designed to classify software without context, Project Ire replicates the gold standard in malware analysis through reverse engineering. It streamlines a complex, expert-driven process, making large-scale malware detection faster & more consistent.

www.microsoft.com

FYI, I voted Hybrid – AI + humans together is the only safe path.

Brainstorming Dan? I don't put it past you to eventually concoct some form of Ai killer feature in Sirius or another specialized track & bite program. BTW i make use of Sirius GPT Scanner and applaud that effort.

 

[ForgottenSeer 114717]

AI, just like any other IT tool, is just a tool. No different than sandbox detonation and it spitting out data. Hooman eyeballs with the requisite level of knowledge and experience need to carefully dissect that output/the results.

Or AI can be developed that interprets what the first AI generated. Good luck with that.

 

[danb]

Brainstorming Dan? I don't put it past you to eventually concoct some form of Ai killer feature in Sirius or another specialized track & bite program. BTW i make use of Sirius GPT Scanner and applaud that effort.

Thank you, I appreciate that! This is interesting because Microsoft apparently kept Project Ire in super stealth mode until August 5, 2025. None of the search engines or AI's knew of Ire, and even people in their other departments did not even know about Ire (very recently). I actually went to high school with someone who used to be on the Project Freta team, which shares most of the same team members with Ire, so Ire seems to be a continuation of Freta. Anyway, he now works at another tech giant.

The other reason this is interesting is that Ire and Sirius are quite similar, and share the exact same objective. The main difference is that Ire uses the shotgun / everything but the kitchen sink approach and tells the LLM what to think, whereas Sirius provides the minimum possible metadata and features to the LLM (within the prompt), and lets the LLM model think / figure everything out on its own. Then if there are misses (mainly false negatives), we can add additional metadata and features to precisely and surgically fix the misses.

I did review the angr framework that Ire is utilizing, and while it is a great framework, we will not be implementing it into Sirius any time soon because it aligns more with the shotgun approach as opposed to our approach. If we were playing poker, I would be saying "I'll stand". I am quite happy with our results, and our code and prompt instructions only need very minor tweaking and optimizations moving forward. I would LOVE to go into detail about all of this (I could write a novel on this), but I need to be very careful what I say.

Having said all that, I do agree that whoever gets LLM malware analysis right, it will be the gold standard in malware classification.

Anyway, I could never even get the guy from high school to even try our software, even though we talked for over a year or two about CyberLock. If I were him, I would have tried it just out of pure curiosity. But ultimately, I am happy that he never tried it, because if he would have, then Sirius might have not ever happened. And most long time CyberLock users who have tried Sirius agree that Sirius will make a killer addition to CyberLock. It is funny how things work out.

 

[EASTER]

Or AI can be developed that interprets what the first AI generated. Good luck with that.

Sounds like a plan. An ambitious one. And doable. You learn in those circles to never underestimate the potential. And many times best innovations erupt out of the table strewn pixie stixs completely by accident.

 

[danb]

AI, just like any other IT tool, is just a tool. No different than sandbox detonation and it spitting out data. Hooman eyeballs with the requisite level of knowledge and experience need to carefully dissect that output/the results.

Or AI can be developed that interprets what the first AI generated. Good luck with that.

There are over 1M new malware samples a day. Each manual review by expert reverse engineers takes anywhere from 5 minutes to weeks to properly analyze. How are they going to reverse that many samples? It's not going to happen. They need AI tools to help them.

VirusTotal

VirusTotal

www.virustotal.com

 

[danb]

It is doable. Actually, I can now say, it's done .* with a little more tweaking and optimization.

 

[ForgottenSeer 114717]

There are over 1M new malware samples a day. Each manual review by expert reverse engineers takes anywhere from 5 minutes to weeks to properly analyze. How are they going to reverse that many samples? It's not going to happen. They need AI tools to help them.

VirusTotal

VirusTotal

www.virustotal.com

I don't care if 1 billion or 1 trillion new malware samples are released per day. A hooman still needs to review the results. My statement never explicitly nor implicitly meant that every single sample needs a manual hooman analysis, but at least the ones where there is reasonable indication that a manual review is prudent/wise.

However, I already know that the hoomans will turn it all over to AI in its entirety due to 1) reduce costs, 2) to eliminate hiring and managing people (because managing people is bunk and its difficult to find the people with the requisite skill and knowledge), and 3) the belief that AI is the solution instead of just merely a tool, and, most importantly, 4) hoomans are lazy.

Currently, there are false negatives galore (and false positives), because 90% of hooman malware analyst positions have been eliminated. Sandbox emulation, scan engines, heuristics, detonation, and so on do only an iffy level of quality. A hooman is always much more accurate if they know what they're doing.

 

[Divergent]

Asking whether AI or human analysts are better for malware detection is the wrong question.
The reality is, the most effective defense uses both working together.

Think about it, with over 1M new threats appearing every day, there's no way humans can keep up alone. That’s where AI becomes essential. It handles the first pass, automatically filtering out the huge volume of common malware.

This frees up the human experts to focus on what they do best, investigating the small percentage of truly new and sophisticated threats. That’s a job that requires human intuition to understand an attacker's motives and creative techniques.

And here’s the best part, everything the experts learn is fed right back into the AI models, making them smarter. It's a powerful cycle of improvement.

So, AI doesn't replace people, it makes them more powerful. This team-up gives you a defense that can handle both massive scale and targeted, intelligent attacks.

 

[ForgottenSeer 114717]

Asking whether AI or human analysts are better for malware detection is the wrong question.

Hoomans are better - if they know what they're doing.

The reality is, the most effective defense uses both working together.

Think about it, with over 1M new threats appearing every day, there's no way humans can keep up alone. That’s where AI becomes essential. It handles the first pass, automatically filtering out the huge volume of common malware.

This frees up the human experts to focus on what they do best, investigating the small percentage of truly new and sophisticated threats. That’s a job that requires human intuition to understand an attacker's motives and creative techniques.

Essentially my point, even though I did not articulate it that way in such detail. But I know hoomans and they will turn it all over to AI. They'll hire and maintain the minimal number of hoomans to manage the AI that manages the AI.

AI that is not regulated with an iron fist is a danger to mankind. Because in capitalism, it will be used to eliminate every hooman from the system possible - all in the name of benefits to the people, efficiency, and to lower costs.

Everyone knows I have no high regard for The Hoomans, but releasing AI from the Genie Bottle without any real plan as to what to do with people who shall be displaced by it is asinine.

All technology firms from one-man shops to huge companies like Google, Microsoft, Oracle, and then world governments, want to use AI as a competitive advantage. That competitive advantage is almost entirely via the elimination of people performing the job function.

 

[simmerskool]

Sounds like a plan. An ambitious one. And doable. You learn in those circles to never underestimate the potential. And many times best innovations erupt out of the table strewn pixie stixs completely by accident.

and I just learned this evening (Nova PBS) that is how AI images are made, ie, one AI system generates a first image, eg, a face, and it is sent to a second AI system with a database of millions of faces, and it sends it back to first, wrong do-over, it was called "adversarial" iirc, and they go thru this loop over and over until first produces a face acceptable to the second. Only takes seconds... If I described it poorly, please watch the Nova "The Deepfake Detective"

 

[danb]

and I just learned this evening (Nova PBS) that is how AI images are made, ie, one AI system generates a first image, eg, a face, and it is sent to a second AI system with a database of millions of faces, and it sends it back to first, wrong do-over, it was called "adversarial" iirc, and they go thru this loop over and over until first produces a face acceptable to the second. Only takes seconds... If I described it poorly, please watch the Nova "The Deepfake Detective"

Yeah, modern LLM AI is truly amazing, and the way it "thinks" aligns extremely well with malware analysis. For years the AI researchers have been trying to mimic neurons in the human brain, which is super cool... but I wonder what is going to happen when the researchers or AI itself figures out that there is an even better way to "think". The human mind is amazing, but it cannot possibly be the absolute best method / medium to process information... there has to be something even better .