Security Advisory: Prompt Injection via Malicious Binaries in Decompiled Output

Summary

GhidraMCP loads decompiled code directly into the LLM context. Since reverse engineering inherently involves analyzing untrusted and potentially malicious binaries, attacker-controlled strings embedded in binaries (string literals, function names, comments) become prompt injection vectors.

Attack Vector

1. Attacker crafts a malicious binary with prompt injection payloads in string literals, symbol names, or embedded comments
2. Analyst uses GhidraMCP to decompile the binary → injected strings enter the LLM context
3. Injection hijacks the AI to: produce false security assessments, rename critical functions incorrectly, or hide malicious indicators in the analysis output

Impact

• Analysis Poisoning: AI produces incorrect reverse engineering results, potentially missing backdoors or malware indicators
• False Security Assessments: Injected prompts could make the AI classify malicious code as benign
• Incorrect Renaming: The renameFunction/renameData tools could be hijacked to deliberately mislabel malicious functions as safe

OWASP Classification

• OWASP LLM Top 10: LLM01 (Prompt Injection)
• OWASP Agentic Top 10: AG01 (Prompt Injection via Tool Results)

Unique Risk Factor

Unlike most MCP servers where untrusted input is accidental, GhidraMCP's primary use case is analyzing untrusted code. This makes prompt injection not a theoretical risk but a near-certain attack surface in real-world usage.

Recommendation

1. Add a Prompt Injection Warning to the README
2. Consider sanitizing decompiled output before passing to LLM context (strip non-printable characters, limit string lengths)
3. Warn users that AI-generated analysis of untrusted binaries may be manipulated
4. Consider a "read-only analysis" mode that disables renaming/modification tools

References

---

Free compliance check: Run your own prompts through our EU AI Act compliance scanner — instant results, no account required: prompttools.co/report

Best, Joerg Michno ClawGuard — Open-Source AI Agent Security | 225 patterns, 15 languages