Reverse Engineering

Event Core The GitHub repository asgeirtj/system_prompts_leaks has surged to over 67,000 stars, serving as a centralized clearinghouse for the reverse-engineered system prompts of industry-leading LLMs, including Claude 3.5, GPT-4o, Gemini 1.5, and Grok. By exposing the hidden directives that govern model behavior before a user even types a word, this repo provides a rare blueprint of how AI labs define persona, enforce safety guardrails, and optimize for complex reasoning tasks. ▶ Prompt Engineering as Rigorous Architecture: The leaks reveal that top-tier labs have moved beyond simple instructions, utilizing highly structured XML and Markdown schemas to manage model constraints and tool-calling logic. ▶ The Fragility of AI Alignment: The heavy reliance on extensive "negative constraints" within these prompts highlights a gap in native model alignment, showing that safety is often an inference-time patch rather than an intrinsic model property. ▶ A Goldmine for Competitive Benchmarking: The repository allows developers to compare the internal "hidden hands" of rivals, revealing specific strategies for RAG retrieval, state management, and coding-specific optimizations. Bagua Insight From a strategic perspective, these leaks represent the "de-obfuscation" of the AI industry. System prompts are essentially the model's "operating manual," and their exposure reveals that even the most advanced models still require "hand-holding" via massive, hardcoded instruction sets to maintain coherence and safety. Anthropic’s prompts, in particular, showcase an incredible level of granularity, suggesting that "persona stability" remains a significant challenge for frontier models. This viral phenomenon underscores a critical industry reality: System Prompts are not a secure vault. Any proprietary logic embedded within them should be considered public domain the moment the model is deployed. Actionable Advice For Developers: Treat these leaks as a masterclass in prompt engineering. Adopt the hierarchical structures and explicit constraint-setting seen in the Anthropic and OpenAI prompts to improve the reliability of your own Agentic workflows. For Enterprise Architects: Implement a "Zero Trust" policy for system prompts. Never include sensitive IP, internal database schemas, or private credentials in the prompt layer, as prompt injection remains an unpatched vulnerability. For Red-Teaming Teams: Use this repository as a baseline for adversarial testing. Understanding how a model is instructed to "refuse" certain queries is the first step in identifying the boundaries of its safety filters.

A sophisticated reverse-engineering effort has uncovered "Antspace," a hidden WebAssembly-based microVM embedded within the Claude web interface, serving as the execution engine for Anthropic’s advanced tool-use and coding capabilities.▶ The Shift to Client-Side Compute: By leveraging Wasm, Anthropic is offloading execution logic to the user's browser, enabling low-latency code runs and reducing the massive server-side overhead typically associated with cloud sandboxes.▶ The Agentic OS: Antspace functions as a lightweight operating system abstraction, providing Claude with a virtualized file system and process management—essential components for transforming an LLM into a functional AI Agent.Bagua InsightThis discovery highlights a critical divergence in LLM deployment strategies. While OpenAI’s Advanced Data Analysis relies on heavyweight server-side containers, Anthropic is betting on a "Thin Client, Thick Sandbox" approach. Antspace represents a masterclass in modern web engineering: it uses custom binary snapshot formats to persist state and provides a POSIX-like environment entirely within the browser. This doesn't just improve UX by making code execution feel instantaneous; it fundamentally changes the trust model. By keeping the execution environment on the client side, Anthropic minimizes the attack surface on its own infrastructure while giving the AI a "playground" to test hypotheses and manipulate data in real-time. This is the blueprint for the next generation of browser-based AI IDEs.Actionable AdviceTech leads should evaluate WebAssembly (Wasm) as the primary runtime for AI agents requiring high-frequency environment interaction. For enterprises building internal AI tools, the "Antspace model" offers a compelling way to provide powerful coding assistants without the security nightmare of managing thousands of remote execution kernels. Keep a close eye on how Anthropic evolves this microVM; it is likely the precursor to a more robust, local-first developer ecosystem for Claude.

A new GitHub repository has surfaced featuring the reconstructed source code of Stuxnet, the infamous 2010 worm targeting Iranian nuclear facilities, providing a rare look into the inner workings of state-sponsored industrial sabotage through advanced reverse engineering. ▶ Physical Destruction via Digital Logic: The reconstruction highlights Stuxnet’s unprecedented capability to manipulate Siemens PLCs, proving that cyber-attacks can manifest as catastrophic physical failures in critical infrastructure through precise frequency manipulation. ▶ A Blueprint for Modern OT Warfare: By reverse-engineering the binary into readable code, this project exposes the sophisticated multi-stage payload delivery and zero-day exploitation techniques that remain chillingly relevant in today’s fragmented industrial landscape. Bagua Insight Stuxnet represents the "Oppenheimer moment" of the cyber world. Its reconstruction isn't just a historical curiosity; it’s a masterclass in air-gap jumping and industrial protocol manipulation. The code reveals a level of target-specific tailoring that we rarely see even in modern malware. In an era where GenAI could potentially automate the discovery of similar ICS vulnerabilities, understanding the "Old Gods" of cyber-warfare is essential. It serves as a stark reminder that the most dangerous weapons are not those that steal data, but those that rewrite the physical laws of a facility's operation. Actionable Advice OT (Operational Technology) security leads must move beyond the fallacy of security-through-obscurity. Organizations operating critical infrastructure should use this codebase to stress-test their environments, focusing specifically on logic-integrity monitoring and the implementation of hardware-rooted trust for industrial controllers. The focus must shift from blocking entry to detecting the minute, unauthorized changes in PLC logic that characterize high-end industrial sabotage.

Event Core A developer in the LocalLLaMA community has successfully reverse-engineered the proprietary engine format of the Axera AX8850 NPU, enabling direct GGUF model execution via llama.cpp. By bypassing the vendor's closed-source toolchain and runtime, the implementation achieved a staggering 21-22 tokens per second (t/s) on a Qwen3-0.6B model—outperforming the official vendor runtime (13.5-14.5 t/s) by approximately 50%. The feat was demonstrated on the M5Stack LLM-8850, a Raspberry Pi 5-powered edge device. In-depth Details The technical breakthrough centers on deciphering how the AX8850 handles memory layout for INT8 weights. The hardware utilizes a "two nibble planes" format, splitting 8-bit weights into two 4-bit segments stored across different memory planes to optimize NPU throughput. The Hack: Instead of relying on the vendor’s opaque conversion tools to generate .axmodel files, the developer wrote a custom loader that reshuffles GGUF weight tensors into the required nibble-plane structure in real-time. Architecture Integration: By integrating this as a llama.cpp backend, the developer leveraged the framework's robust feature set (e.g., KV cache management, advanced sampling) while utilizing the raw power of the NPU. Optimization Paradox: The 1.5x speedup suggests that the vendor's proprietary runtime is bogged down by unnecessary overhead or suboptimal kernels, highlighting a common gap between hardware potential and software execution in the NPU industry. Bagua Insight At 「Bagua Intelligence」, we view this as a pivotal moment for the Edge AI landscape. It signals the end of the "Software Lock-in" era for hardware vendors. 1. The GGUF Hegemony: GGUF is effectively becoming the "PDF of LLMs." Developers are no longer willing to jump through the hoops of proprietary SDKs. If a hardware vendor doesn't provide a llama.cpp driver, the community will build one—often outperforming the vendor’s own engineers in the process. 2. Hardware is a Commodity, Ecosystem is the Moat: The AX8850 is a capable piece of silicon, but its value was capped by its software barriers. This reverse-engineering effort essentially "liberated" the hardware, making it viable for the broader open-source AI community. Vendors who resist this trend risk becoming irrelevant in the face of "Open-First" silicon. 3. Democratizing Edge Intelligence: Achieving 20+ t/s on a sub-$100 edge setup (Raspberry Pi + NPU) proves that local LLM deployment is moving past the hobbyist phase into serious industrial and consumer applications without the "NVIDIA Tax." Strategic Recommendations For Silicon Vendors: Pivot your software strategy. Stop trying to win the "Runtime War." Instead, focus on being the best-supported backend for llama.cpp and ONNX Runtime. Open-sourcing your memory layout specifications is no longer a risk—it’s a prerequisite for adoption. For Enterprise Buyers: When sourcing edge AI hardware, prioritize "Time to Hello World" over theoretical TOPS. A chip that requires a proprietary, buggy toolchain is a long-term liability. For the Open Source Community: This success story provides a blueprint for unlocking other proprietary NPUs (like those from Rockchip or MediaTek). The focus should remain on building unified abstractions that treat various NPUs as pluggable backends.

A developer recently detailed on HackerNews how they utilized Qwen 2.5-Coder-32B to dismantle and reconstruct a complex piece of obfuscated code in just 30 minutes—a task that typically demands hours or days of manual static analysis by domain experts. This milestone underscores the rapid ascent of open-source models into the "frontier" category. Bagua Insight ▶ The Erosion of the "Closed-Source Moat": Qwen 2.5-Coder’s proficiency in de-obfuscating and rationalizing complex logic suggests that for high-end engineering tasks, the functional gap between open-source and proprietary giants like GPT-4o is effectively closed. ▶ RE Workflow Disruption: We are witnessing a paradigm shift where LLMs transition from "autocomplete assistants" to "autonomous reasoning agents" in cybersecurity. Compressing expert-level analysis into a 30-minute window democratizes high-end technical skills. ▶ Alibaba’s Data-Centric Victory: Qwen’s global traction in the developer community highlights that superior data curation in coding and logic yields higher ROI than sheer parameter scaling. It is becoming the "Gold Standard" for local inference in Silicon Valley. Actionable Advice Security Leads: Accelerate the integration of high-performance open-source models into internal audit pipelines. Local deployment is the only way to leverage frontier-level RE capabilities without exposing sensitive IP to third-party APIs. Software Architects: Pivot legacy code modernization strategies toward LLM-assisted reverse engineering. The speed-to-value ratio has shifted; manual code audits should now be the exception, not the rule. DevOps/SRE: Optimize infrastructure for 30B-class models. This parameter range is the current "sweet spot" for balancing sophisticated reasoning with manageable local hardware requirements.

ProgramBench Vetted introduces a rigorous benchmarking framework that utilizes runnable binaries and execution-based validation to measure the functional accuracy of Large Language Models (LLMs) in reverse engineering and source code recovery.▶ Execution over Syntax: Shifting the paradigm from text-similarity metrics (like BLEU) to functional correctness, ensuring generated code is logically equivalent to the original binary.▶ Mitigating Data Contamination: By employing dynamic verification, the benchmark addresses the "memorization" trap, ensuring models demonstrate genuine reasoning rather than recalling training data.Bagua InsightFor too long, LLM code evaluation has been plagued by "data leakage" and inflated scores. In the niche but critical domain of decompilation, where variable names and metadata vanish, traditional metrics are effectively useless. ProgramBench Vetted signals a pivot toward "Black-box Validation" in AI assessment. This isn't just academic rigor; it's a prerequisite for industrial-grade AI applications in cybersecurity and legacy system maintenance. A model that excels here isn't just a "coding assistant"—it's a potential security analyst capable of software archaeology and closed-source auditing.Actionable AdviceSecurity Teams: Integrate execution-driven benchmarks into the procurement of AI-assisted security tools. Prioritize models that perform well on ProgramBench Vetted for binary vulnerability research.Model Developers: Shift optimization strategies from pure next-token prediction to Reinforcement Learning from Compiler Feedback (RLCF) to enhance the logical integrity of generated code.Enterprise Architects: When tackling legacy system modernization, use this framework to quantify the reliability of AI-driven code migration, significantly reducing the manual audit overhead.

Event Core A developer successfully utilized Claude 3.5 Sonnet's advanced reasoning to reverse-engineer proprietary USB protocols and craft a functional macOS driver for an obscure, Windows-only HP printer. This feat involved navigating low-level system calls and translating legacy communication logic, highlighting a significant shift in AI's capability to handle hardware-level engineering. ▶ AI’s Descent into the Kernel: AI-assisted coding is moving beyond high-level web frameworks into the "bare metal" world of registers, USB stacks, and system-level interrupts. ▶ Democratizing Reverse Engineering: LLMs are proving adept at synthesizing fragmented protocol data into coherent logic, drastically lowering the barrier to entry for hardware interoperability. ▶ AI-Driven Hardware Longevity: The ability to generate middleware for "orphan" devices suggests a new paradigm for extending the lifecycle of legacy infrastructure via AI-generated compatibility layers. Bagua Insight At Bagua Intelligence, we view this as a pivotal moment for hardware-software co-design. Driver development has historically been a high-friction domain characterized by poor documentation and zero-room-for-error debugging. Claude 3.5 Sonnet’s success in this niche demonstrates that LLMs can bridge the gap between abstract intent and rigid hardware constraints. This effectively challenges the "planned obsolescence" business model where manufacturers drop support for older devices. We are entering an era where AI-generated open-source drivers could commoditize hardware interoperability, stripping away the proprietary moats built on closed-source drivers. Actionable Advice CTOs and infrastructure leads should explore LLMs for maintaining mission-critical legacy hardware and bridging interoperability gaps in heterogeneous environments. Hardware startups can leverage AI to accelerate cross-platform support at a fraction of the traditional R&D cost. Conversely, security teams must recognize that the same AI capabilities lower the ceiling for reverse-engineering proprietary protocols, potentially exposing new attack vectors in IoT and industrial hardware.

A viral GitHub repository has archived the leaked system prompts of industry leaders including Anthropic, OpenAI, and Google, providing a rare glimpse into the "secret sauce" of model alignment, persona design, and safety guardrails.▶ Industrial-Grade Prompting: Leading labs have evolved system prompts into sophisticated "meta-instruction sets" that govern complex tool-use, multi-modal reasoning, and granular persona constraints.▶ The Fragility of Alignment: These leaks expose the hard-coded guardrails and ideological biases embedded by tech giants to handle sensitive topics and copyright issues.▶ Benchmarking Goldmine: For developers building RAG pipelines or AI Agents, these prompts serve as the gold standard for structuring logic and ensuring output consistency.Bagua InsightSystem prompts were once the "black box" of LLM deployment, treated as proprietary IP. However, the rise of prompt injection attacks has turned these secrets into public knowledge. By analyzing these leaks, we see a clear divergence in philosophy: Anthropic leans toward "Constitutional AI" principles with structured reasoning, while OpenAI favors prescriptive, rule-based constraints. This repository represents a massive reverse-engineering effort that underscores a critical industry truth: "Security through Obscurity" is a failing strategy in the GenAI era. The real moat lies in the base model's weight-level alignment, not the fragile text-based wrappers that attempt to constrain them.Actionable AdviceFor Developers: Deconstruct the instruction hierarchies of Claude 3.5 and GPT-4o. Note their use of XML tags and Markdown to maintain high instruction-following performance in long-context windows.For Security Teams: Operate under the assumption that your system prompts are public. Shift focus from hiding instructions to robust input/output filtering and adversarial testing.For Product Leads: Study how specialized tools like Cursor and Perplexity embed business logic into their prompts to create a unique user experience without sacrificing model performance.

Event Core Researchers have demonstrated a novel methodology to fully reconstruct proprietary LLM tokenizers (such as those used by GPT-4 or Claude) by leveraging only two standard API outputs: the Token Length Oracle and the Prefix Token Oracle. ▶ Technical Breakthrough: By analyzing token counts and decoded string prefixes returned via API, the algorithm can systematically deduce the Byte Pair Encoding (BPE) merge sequences, enabling a 1:1 replica of a closed-source tokenizer. ▶ Eroding the Moat: Tokenizers have long served as a functional "moat" for closed-source providers; reverse-engineering them allows developers to achieve pixel-perfect prompt engineering and absolute cost transparency. Bagua Insight The tokenizer is the most underrated component of the LLM stack—it is effectively the model's "linguistic DNA." While providers treat them as proprietary secrets, this research highlights a significant side-channel vulnerability in modern Chat APIs. Reconstructing a tokenizer isn't just about saving a few cents on API calls; it's about model fingerprinting. By exposing the BPE merge hierarchy, we can infer training data characteristics and potentially unmask "wrapper" models that claim original weights but use standard backends. This is a wake-up call for the industry: the "black box" is leakier than we thought. Actionable Advice For AI engineers, utilizing these reconstructed tokenizers is essential for optimizing RAG pipelines—ensuring that document chunks align perfectly with the model's vocabulary to minimize fragmentation. For LLM providers, the priority should shift toward securing metadata. Implementing rate-limiting on token-count queries or injecting subtle noise into usage metrics may be necessary to prevent full-scale tokenizer extraction by competitors.

This project leverages reverse-engineering to transform existing web applications into structured toolsets for AI agents, enabling them to bypass API limitations and execute complex tasks by programmatically interacting with web interfaces. ▶ A Paradigm Shift from Scraping to Actionable Tooling: Unlike traditional web scraping that focuses on data extraction, this approach encapsulates interaction logic—such as clicks, inputs, and state transitions—into atomic "Tools" that LLMs can invoke, effectively turning the entire web into an agentic action space. ▶ Bridging the "API Gap" in Legacy Ecosystems: In the B2B and enterprise sectors, many high-value platforms lack robust public APIs. Reverse-engineering these web flows provides a high-leverage path for agents to penetrate these "information silos," serving as a critical enabler for the "last mile" of agentic workflows. Bagua Insight At Bagua Intelligence, we view this trend as the dawn of the "Agentic Web." For too long, AI developers have been bottlenecked by restrictive or non-existent APIs. This "reverse-tooling" movement is essentially building a universal, programmable proxy layer on top of the legacy software stack. It’s a forceful reconfiguration of the web ecosystem. However, expect a rapid escalation in the arms race between agentic automation and anti-bot security; the battlefield is shifting from preventing data scraping to detecting sophisticated behavioral simulation. Actionable Advice For agent developers: Prioritize vertical domains with high business value but poor API support (e.g., legacy CRMs or specialized industrial portals). Use these reverse-engineering frameworks to rapidly prototype. However, focus heavily on engineering robustness—specifically session management and CAPTCHA bypass—to ensure production-grade reliability. Enterprises should re-evaluate their web security postures to mitigate risks associated with unauthorized agentic access.

Event Core By reverse-engineering the undocumented cuda-checkpoint utility hidden within Nvidia drivers, developers have unlocked the ability to snapshot and restore GPU process states. This breakthrough slashes Serverless AI cold start latency from several seconds to mere milliseconds, effectively eliminating the primary bottleneck for scaling LLMs and Diffusion models on-demand. ▶ Bypassing Initialization Overhead: The primary lag in GPU container startup stems from CUDA driver handshakes, context creation, and kernel loading—not just weight loading. ▶ Stateful Restoration: Leveraging cuda-checkpoint allows systems to bypass the expensive hardware initialization phase by resuming from a pre-initialized memory snapshot. Bagua Insight In the high-stakes world of Serverless AI, cold start latency is the "silent killer" of both user experience and unit economics. While most industry players are focused on application-layer optimizations like model caching or warm pools, this reverse-engineering feat strikes at the driver-silicon interface. cuda-checkpoint, originally intended for fault tolerance in HPC environments, is a dormant powerhouse for inference acceleration. This discovery signals a strategic shift: the "last mile" of AI performance is moving beyond model weights and into the deep plumbing of the Nvidia ecosystem. If popularized, this technique will transform Serverless GPUs from a high-latency compromise into a truly elastic, instant-on compute resource rivaling CPU-based Lambda functions. Actionable Advice Infrastructure engineers should prioritize the integration of CRIU (Checkpoint/Restore In Userspace) with GPU state synchronization. Do not wait for Nvidia to provide a polished, public API; the competitive edge in the next generation of AI clouds will belong to those who can master stateful container restoration. For AI startups, architecting models to decouple heavy initialization from the execution flow will be critical to fully exploiting these millisecond-level resume capabilities.