{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/microsoft-project-ire-malware-classification-2025/",
 "asOf": "2026-09-26",
 "id": "microsoft-project-ire-malware-classification-2025",
 "date": "2025-08-05",
 "datePrecision": "day",
 "title": "Microsoft's Project Ire agent autonomously reverse engineers and classifies malware",
 "lane": "defense",
 "kind": "tool-release",
 "summary": "Microsoft Research describes Project Ire, a prototype LLM agent that uses decompilers and binary analysis tools to reverse engineer software and classify it as malicious or benign, producing an auditable chain-of-evidence report. Microsoft reports 0.98 precision and 0.83 recall on a Windows driver dataset, but 0.26 recall on about 4,000 hard real-world files, and plans to deploy it in Defender as Binary Analyzer.",
 "whyItMatters": "It is a rare defensive-agent announcement that publishes both strong and weak results, including low recall on hard samples.",
 "actors": [
  "microsoft"
 ],
 "topics": [
  "autonomous-defense",
  "soc-automation"
 ],
 "atlas": [
  "tools"
 ],
 "artifacts": [
  "project-ire"
 ],
 "sources": [
  {
   "url": "https://www.microsoft.com/en-us/research/blog/project-ire-autonomously-identifies-malware-at-scale/",
   "publisher": "Microsoft Research Blog",
   "title": "Project Ire autonomously identifies malware at scale",
   "date": "2025-08-05",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Windows drivers dataset: precision 0.98, recall 0.83, 2% false positive rate.",
   "locator": "Evaluation section"
  },
  {
   "fact": "About 4,000 'hard-target' real-world files: precision 0.89, recall 0.26, 4% false positive rate.",
   "locator": "Evaluation section"
  },
  {
   "fact": "Microsoft says Project Ire was the first reverse engineer at Microsoft, human or machine, to author a conviction case for automatic blocking of a specific APT sample.",
   "locator": "Blog post"
  },
  {
   "fact": "The prototype will be used in Defender as Binary Analyzer.",
   "locator": "Blog post, deployment note"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-076"
 ],
 "methods": [],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}