{"id":7020,"date":"2026-11-09T07:33:16","date_gmt":"2026-11-09T07:33:16","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering"},"modified":"2026-11-09T07:33:16","modified_gmt":"2026-11-09T07:33:16","slug":"bla-blind-llm-agents-rea-reverse-engineering","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/bla-blind-llm-agents-rea-reverse-engineering","title":{"rendered":"BLA (Blind LLM Agents) vs. REA: Open-Source Tool Tries to Blind AI Reverse-Engineering Agents"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The open-source tool REA \u2014 &#8220;reverse engineer anything with agents&#8221; \u2014 lets AI coding agents unpack apps, trace their internals and reconstruct business logic in minutes. Now a solo developer has released the counter-move. <strong>BLA (Blind LLM Agents)<\/strong> modifies a program&#8217;s release build so that AI reverse-engineering agents hit their own resource limits, chase decoy code and fake credentials, and burn tokens \u2014 while, its author says, real users run exactly the same app. Viral threads over the weekend declared REA &#8220;bankrupt.&#8221; The repository&#8217;s own documentation is more careful, and that gap is the story.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What it is:<\/strong> An MIT-licensed CLI and MCP server (npm: bla-agents) that audits, &#8220;hardens&#8221; and verifies build artifacts \u2014 JavaScript bundles, Electron .asar archives, WebAssembly, Python, SQLite, model files and native binaries.<\/li><li><strong>How it works:<\/strong> &#8220;Poison \u2192 Exhaust \u2192 Hallucinate&#8221;: plant plausible decoys and canary keys, inflate artifacts past documented REA limits, and steer agents toward shadow logic.<\/li><li><strong>The claims:<\/strong> The README says hardened artifacts make analyzers burn &#8220;300\u00d7\u20132,800\u00d7 more tokens,&#8221; and that 14 of 14 bundled benchmark targets pass runtime-equivalence checks. It labels the token and dollar figures &#8220;internal estimates.&#8221;<\/li><li><strong>The traction:<\/strong> Created on October 25, the GitHub repo had more than 3,900 stars and 480 forks by November 9, helped by near-identical promotional threads on X.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">BLA has been public since late October, but it took off on X after November 7, when the account <a href=\"https:\/\/x.com\/0xCodila\/status\/2119147351604601206\" target=\"_blank\" rel=\"noreferrer noopener\">@0xCodila<\/a> posted a setup guide headlined &#8220;REA (reverse engineer anything) &#8211; F*CKED by chinese student&#8230;&#8221; that drew about 6,000 likes. Several other accounts followed with almost the same wording. The developer, <a href=\"https:\/\/x.com\/xteam3301\/status\/2119408020342140932\" target=\"_blank\" rel=\"noreferrer noopener\">Timo Zhang (@xteam3301)<\/a>, who publishes as qybaihe on GitHub, described himself as a Chinese student and the project as &#8220;built solo.&#8221; He wrote that BLA reached &#8220;3,278\u2605 in weeks&#8221; with 407 forks; GitHub&#8217;s API showed 3,937 stars and 485 forks on November 9. npm lists the latest version as 3.2.1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The usage pattern in the threads is simple: install via npx, run <code>npx bla-agents setup<\/code> to register BLA with a coding agent such as Claude Code, Cursor, Codex or Gemini CLI, then <code>npx bla-agents harden<\/code>, and ship the files from the new <code>.bla-hardened<\/code> folder instead of the original build.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Background: why REA made developers nervous<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/morluto\/rea\" target=\"_blank\" rel=\"noreferrer noopener\">REA<\/a> (morluto\/rea) describes itself as a tool to &#8220;reverse engineer anything with agents, from app behavior down to native binaries.&#8221; BLA&#8217;s README summarizes the threat from the defender&#8217;s side: AI reverse-engineering agents &#8220;unpack .asar archives, recover SourceMaps, trace IPC bridges, inspect .wasm \/ .sqlite \/ .safetensors, and clone core business logic in seconds for ~$0.20.&#8221; For makers of desktop apps, games and paid features shipped in client code, that turns reverse engineering from a specialist&#8217;s job into a one-command task.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Classic obfuscation does not help much. As BLA&#8217;s documentation argues, renaming variables to strings like <code>_0x1a2b<\/code> is something &#8220;modern LLMs effortlessly summarize.&#8221; Model-extraction and IP-protection questions have been a recurring theme on i10x, from <a href=\"https:\/\/i10x.ai\/news\/ai-model-extraction-defenses\">AI model extraction defenses<\/a> to this week&#8217;s <a href=\"https:\/\/i10x.ai\/news\/claude-code-settings-local-json-secrets-leak\">Claude Code secrets leak<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How it works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">BLA&#8217;s <a href=\"https:\/\/github.com\/qybaihe\/bla\" target=\"_blank\" rel=\"noreferrer noopener\">README<\/a> describes four pillars. <strong>Poison<\/strong> plants &#8220;format-valid canaries,&#8221; fake enclave manifests, honey source maps and &#8220;plausible shadow state machines.&#8221; <strong>Exhaust<\/strong> deliberately trips the exact limits REA documents \u2014 for example a 16 MiB ASAR header limit or 32-level nesting for model metadata \u2014 so analysis downgrades from &#8220;COMPLETE&#8221; to &#8220;LIMITED&#8221; or fails. <strong>Entangle<\/strong> binds JavaScript, WebAssembly and native sidecars with runtime hashes so decoys cannot simply be stripped. A <strong>runtime<\/strong> layer detects debuggers such as Chrome DevTools Protocol or Frida and serves &#8220;believable synthetic telemetry.&#8221; A <a href=\"https:\/\/github.com\/qybaihe\/bla\/blob\/main\/.agents\/skills\/blind-llm-agents\/references\/counter-rea-matrix.md\" target=\"_blank\" rel=\"noreferrer noopener\">24-vector matrix<\/a> maps each REA source-code limit to a BLA countermeasure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The decoy logic sits behind opaque predicates that always evaluate the same way at runtime, which is how BLA claims &#8220;100% runtime equivalence.&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Format<\/th><th>Size before \u2192 after<\/th><th>REA outcome after BLA (per BLA)<\/th><\/tr><\/thead><tbody><tr><td>Electron ASAR<\/td><td>607 B \u2192 16.9 MiB<\/td><td>Capacity error at the 16 MiB header limit<\/td><\/tr><tr><td>JavaScript<\/td><td>761 B \u2192 116 KiB<\/td><td>Budget rejected (alias, getter, primitive limits)<\/td><\/tr><tr><td>WASM + Wabt<\/td><td>54 B \u2192 6.56 MiB, 251 exports<\/td><td>Partial interface decoding<\/td><\/tr><tr><td>SQLite (Node 24)<\/td><td>12 KiB \u2192 56 KiB<\/td><td>Evaluation trap on virtual columns<\/td><\/tr><tr><td>Go buildinfo<\/td><td>50 KiB \u2192 1.16 MiB<\/td><td>Capacity error at 1 MiB build-info limit<\/td><\/tr><tr><td>Safetensors<\/td><td>128 B \u2192 10.1 KiB<\/td><td>Capacity error: JSON nesting over 32 levels<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The table above lists results BLA reports from running the real REA against hardened samples. A separate 14-target &#8220;showcase&#8221; reports token multipliers from 105.6\u00d7 to 2,822.7\u00d7 (about 639.5\u00d7 on aggregate); the README states those columns are &#8220;internal estimates derived from BLA&#8217;s catalog of REA limits.&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pros and cons<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">For users<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> If it works as described, apps behave the same while competitors find it costlier to clone paid features.<\/li><li><strong>Con:<\/strong> Hardened artifacts can grow dramatically \u2014 an ASAR from 607 bytes to 16.9 MiB in BLA&#8217;s own test \u2014 which may affect download size and startup.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">For developers<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> Free, local, one command, with an MCP integration for common coding agents and bundler plugins for Vite, Rollup, Webpack and esbuild.<\/li><li><strong>Con:<\/strong> Tests pass on 14 bundled fixtures; for real projects the README says to &#8220;run your project&#8217;s test suite.&#8221; Debugging hardened builds and handling crash reports from decoy code paths adds work.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">For companies<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Pro:<\/strong> Raises the cost of automated cloning of client-side logic, the cheapest attack REA enables.<\/li><li><strong>Con:<\/strong> Defenses tuned to one tool&#8217;s published limits can be undone by a new REA release; anti-debugging and decoy credentials may also trip app-store review, security scanners or customers&#8217; own audits.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What X is saying<\/h2>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">REA (reverse engineer anything) &#8211; F*CKED by chinese student&#8230; solo dev just dropped protection for your app &amp; site &amp; game from reverse-engineering and AI hackers, for free<\/p>&mdash; codila (@0xCodila) <a href=\"https:\/\/x.com\/0xCodila\/status\/2119147351604601206\" target=\"_blank\" rel=\"noreferrer noopener\">November 7, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">REA is the most dangerous repo on the internet&#8230; so I built the thing that blinds it. \ud83d\udee1\ufe0f 3,278\u2605 in weeks. 407 forks. built solo by a chinese student. it&#x27;s called BLA (Blind LLM Agents).<\/p>&mdash; Timo Zhang (@xteam3301) <a href=\"https:\/\/x.com\/xteam3301\/status\/2119408020342140932\" target=\"_blank\" rel=\"noreferrer noopener\">November 8, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<blockquote class=\"twitter-tweet i10x-x-embed\"><p lang=\"en\" dir=\"ltr\">ONE CHINESE STUDENT JUST MADE REA 100\u00d7 MORE ANNOYING TO USE&#8230; A solo dev released BLA &#8211; Blind LLM Agents, a free hardening layer built to make reverse-engineering tools and AI agents waste time on the wrong things.<\/p>&mdash; Ricker (@0xRicker) <a href=\"https:\/\/x.com\/0xRicker\/status\/2119466114941874312\" target=\"_blank\" rel=\"noreferrer noopener\">November 8, 2026 \u00b7 View on X<\/a><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">The author himself pushed back on the hype in a <a href=\"https:\/\/x.com\/xteam3301\/status\/2119414785649553894\" target=\"_blank\" rel=\"noreferrer noopener\">reply<\/a>: &#8220;BLA is Counter-REA (poison\/exhaust\/hallucinate against agent budgets), not classic human obfuscation. We don&#8217;t claim Ghidra\/IDA sessions are bankrupt unless measured.&#8221; Skeptics were blunter; one user replied simply: <a href=\"https:\/\/x.com\/0xkutluer\/status\/2119248031908327746\" target=\"_blank\" rel=\"noreferrer noopener\">&#8220;just rea the bla and bypass it lmao.&#8221;<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Critical analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">BLA is a clever idea with honest documentation and an overheated marketing wave. The repository is careful: it says token and cost figures in its showcase are estimates, that &#8220;empirically verified&#8221; refers only to the REA paths it ran, and that it is &#8220;not a claim about Ghidra\/Frida\/LLDB\/Rizin\/JADX sessions we did not run here.&#8221; The viral threads drop every one of those qualifiers. Many of them share the same template text \u2014 one even ends with the leftover line &#8220;Want a more aggressive, shorter, or more technical version? Just say,&#8221; a strong hint that it was pasted from an AI assistant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technically, BLA attacks the analyzer rather than the analyst. That is effective as long as REA keeps the same limits, and fragile once it doesn&#8217;t: raising a 16 MiB cap or ignoring files over a size threshold is a small patch. Decoys work against agents that trust what they read; a well-instructed agent \u2014 or a human \u2014 that verifies behavior at runtime may still get through, especially as BLA&#8217;s runtime shield only fools debugging tools it detects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The bigger picture is an arms race in which both sides are open source and both are driven by AI agents. That favors whoever updates faster, and it means BLA&#8217;s protection is best seen as raising cost, not providing security. Anything truly secret \u2014 keys, pricing logic, license checks \u2014 still belongs on a server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s still open<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Will REA&#8217;s maintainers adjust limits or add decoy detection, and how quickly can BLA respond?<\/li><li>Do independent tests on real-world apps confirm runtime equivalence and acceptable size and performance overhead?<\/li><li>How will app stores and enterprise security scanners treat builds containing fake credentials and anti-debugging code?<\/li><li>Will commercial obfuscation vendors adopt &#8220;agent budget exhaustion&#8221; as a standard feature?<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This independent, research-based i10x analysis is based on the BLA GitHub repository and README (qybaihe\/bla), the project&#8217;s website, GitHub and npm metadata retrieved on November 9, 2026, the REA repository description, and public posts on X from November 5\u20139. i10x did not run BLA or REA. Performance figures are the project&#8217;s own and partly labeled as estimates.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/qybaihe\/bla\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub: qybaihe\/bla \u2014 BLA (Blind LLM Agents)<\/a><\/li><li><a href=\"https:\/\/bla.tools\/\" target=\"_blank\" rel=\"noreferrer noopener\">bla.tools \u2014 official site<\/a><\/li><li><a href=\"https:\/\/www.npmjs.com\/package\/bla-agents\" target=\"_blank\" rel=\"noreferrer noopener\">npm: bla-agents<\/a><\/li><li><a href=\"https:\/\/github.com\/qybaihe\/bla\/blob\/main\/.agents\/skills\/blind-llm-agents\/references\/counter-rea-matrix.md\" target=\"_blank\" rel=\"noreferrer noopener\">BLA: 24-vector Counter-REA matrix<\/a><\/li><li><a href=\"https:\/\/github.com\/morluto\/rea\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub: morluto\/rea<\/a><\/li><li><a href=\"https:\/\/x.com\/xteam3301\/status\/2119414785649553894\" target=\"_blank\" rel=\"noreferrer noopener\">Timo Zhang on X: what BLA does not claim<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AI agents have made reverse engineering cheap, and BLA shows the natural response: make it expensive again by attacking the agent&#8217;s budget and trust. Expect this to become a product category \u2014 &#8220;anti-agent hardening&#8221; \u2014 alongside traditional obfuscation and code signing. But developers should read the README, not the threads. A defense tuned to one open-source tool&#8217;s published limits is a speed bump, and the only durable protection for valuable logic is not shipping it to the client in the first place.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>BLA (Blind LLM Agents), an MIT-licensed tool by solo developer Timo Zhang (GitHub: qybaihe), hardens Electron, WebAssembly, JavaScript, Python and native builds against AI reverse-engineering agents such as REA by planting decoys, fake keys and inputs that trip analyzer limits. Its README claims 300\u00d7\u20132,800\u00d7 more tokens for attackers \u2014 figures it labels internal estimates. The repo passed 3,900 GitHub stars by November 9.<\/p>\n","protected":false},"author":2,"featured_media":7019,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"28"},"categories":[14,22,28],"tags":[],"companies":[],"products":[],"class_list":["post-7020","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-coding","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>BLA (Blind LLM Agents) vs. REA: How It Works<\/title>\n<meta name=\"description\" content=\"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BLA (Blind LLM Agents) vs. REA: How It Works\" \/>\n<meta property=\"og:description\" content=\"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-09T07:33:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"BLA (Blind LLM Agents) vs. REA: Open-Source Tool Tries to Blind AI Reverse-Engineering Agents\",\"datePublished\":\"2026-11-09T07:33:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering\"},\"wordCount\":1525,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/bla-blind-llm-agents-rea-reverse-engineering-title.webp\",\"articleSection\":[\"Agents\",\"Coding\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-09T07:33:16+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering\",\"name\":\"BLA (Blind LLM Agents) vs. REA: How It Works\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/bla-blind-llm-agents-rea-reverse-engineering-title.webp\",\"datePublished\":\"2026-11-09T07:33:16+00:00\",\"description\":\"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/bla-blind-llm-agents-rea-reverse-engineering-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/bla-blind-llm-agents-rea-reverse-engineering-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A flashlight beam bounces through a hall of mirrors with a laptop on a stool in the foreground.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/bla-blind-llm-agents-rea-reverse-engineering#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BLA (Blind LLM Agents) vs. REA: Open-Source Tool Tries to Blind AI Reverse-Engineering Agents\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"BLA (Blind LLM Agents) vs. REA: How It Works","description":"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering","og_locale":"en_US","og_type":"article","og_title":"BLA (Blind LLM Agents) vs. REA: How It Works","og_description":"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.","og_url":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering","og_site_name":"i10X News","article_published_time":"2026-11-09T07:33:16+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"BLA (Blind LLM Agents) vs. REA: Open-Source Tool Tries to Blind AI Reverse-Engineering Agents","datePublished":"2026-11-09T07:33:16+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering"},"wordCount":1525,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp","articleSection":["Agents","Coding","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-09T07:33:16+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering","url":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering","name":"BLA (Blind LLM Agents) vs. REA: How It Works","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp","datePublished":"2026-11-09T07:33:16+00:00","description":"BLA (Blind LLM Agents) plants decoys and token traps in builds to slow AI reverse-engineering agents like REA. Claims, caveats and what developers should know.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/bla-blind-llm-agents-rea-reverse-engineering-title.webp","width":1344,"height":768,"caption":"A flashlight beam bounces through a hall of mirrors with a laptop on a stool in the foreground."},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/bla-blind-llm-agents-rea-reverse-engineering#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"BLA (Blind LLM Agents) vs. REA: Open-Source Tool Tries to Blind AI Reverse-Engineering Agents"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7020"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7020\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7019"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7020"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7020"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}