For AI labs and security evaluation teams
Evaluate and improve agents with a persistent Ghidra-backed workspace, isolated Linux execution, expert intervention, and measurable trajectories.
Cybersecurity agent evaluation environment
The problem
Prompt-and-tool agents lose analysis state, execute samples inconsistently, and leave behind transcripts that cannot show whether the reverse-engineering task was actually completed.
Symbols, annotations, runtime evidence, and analyst decisions are split across independent tools and conversations.
Runs without isolation, explicit limits, and reset semantics are difficult to reproduce or evaluate safely.
A plausible answer does not establish which actions were taken or whether the binary confirmed the conclusion.
Expert corrections remain trapped in chat instead of becoming attributed signals tied to the exact analysis state.
Illustrative ELF episode
Task: determine how an authorized ELF binary validates a license.
Environment loop / Managed pilot
Available now
Customer agents and human analysts share one durable investigation. They do not have to stitch together disconnected tool calls.
01 / ANALYSIS
Ghidra-backed decompilation and disassembly with graphs, symbols, strings, cross-references, hex, notes, and findings.
Analysis. Ghidra-backed decompilation, disassembly, graphs, symbols, strings, cross-references, hex, notes, and findings.
Agents. Customer agents connect through MCP and use session tools within the caller's permissions.
State. Sessions preserve analysis, notes, findings, and attributed activity for humans and agents.
Runtime. Live debugging exposes execution, registers, memory, breakpoints, modules, and terminal I/O.
Independent calls and transient context
One durable investigationAnswers without attributable evidence
Actions + corrections + outcomesExecution without episode semantics
Controlled, observable runsCurrent platform / reverser.space
Managed pilot
We integrate the customer’s agent, run an authorized corpus inside a dedicated tenant, and deliver repeatable evaluation with structured trajectories.
Working deployment
Measurable evaluation
Customer brings
Model and agent framework
Authorized sample corpus
Evaluation goals and acceptance criteria
Pilot produces
Working agent integration
Reproducible scored runs
Structured trajectory export
Pilot contract / Scope finalized with design partner
Technical appendix
The shared analysis plane preserves reasoning context. The isolated execution plane produces observable runtime outcomes. The evaluator turns both into a structured record.
Customer framework
Authorized corpus
MCPGhidra worker
Persistent state
Human supervisor
Create → execute
Observe → terminate
Destroy → reset
Customer binaries and trajectories remain isolated and are not reused to train shared models.
Each managed-pilot run starts in a fresh private VM with no public address, service account, NAT path, or permitted egress.
Operators can inspect the trajectory, correct the shared state, take control, and stop execution.
Customers must provide samples they own or are explicitly authorized to analyze.
Architecture / Security boundaries
The compounding layer
Every investigation produces grounded actions, observable outcomes, and expert corrections that can improve how reverse-engineering agents work.
Production investigation, evaluation, red-teaming, and reinforcement learning can share the same operational substrate.
Expert interventions create attributed, tool-grounded signals tied to the exact state that required them.
Persistent tools and observable consequences reveal what an agent can actually do, not only what it can say.
Design partners
Current focus: native Linux x86-64 ELF for live debugging and managed-pilot detonation.
Pilot scope: integration, corpus, evaluator, acceptance thresholds, and operating boundaries are agreed with each design partner.
Reverser Space / Design-partner brief