LLM agents crack software protection in minutes

The author of the AP Security blog demonstrated that the Grok Build agent, connected to an IDA Pro MCP server, cracked a VM crackme in about 4 minutes with a simple prompt, and on commercial software, patched the instruction 'movzx eax, dil' to unlock the full version.

Compiled by Sergey KostenchukPublished 2026-09-21Updated 2026-09-21

2026-09-21 Safety xAI

🛡 LLM agents crack software protection in minutes

On a VM crackme (a virtual machine with 23 opcodes and a 16-round key-checking algorithm, built on 'GPT-6 Astra'), the Grok Build agent with a connected IDA MCP server gave up in about 4 minutes with a simple prompt, without any special prompting. On the author's commercial software, it annotated the licensing pseudocode and patched the instruction 'movzx eax, dil' ('always return 1') to unlock the full version.

🌍 The combination of IDA Pro and an MCP server — a bridge from 'disassembler to agent' — compresses manual reverse engineering from hours into a 4-minute session. VM packers are no longer a barrier; developers of protection systems and DRM need to rethink their threat models.

👤 The barrier to entry for cracking is collapsing: the author calls agents a '10x multiplier' with basic reverse engineering experience. Caveat: the source has no data on successful and unsuccessful attempts, only wins.

Source 1: https://apsecurity.dev/posts/cracking-software-with-ai/

Sources