Microsoft’s new AI agent independently detects and blocks malware

Microsoft has introduced a groundbreaking artificial intelligence system capable of autonomously identifying and blocking malware, without any human intervention. Named Project Ire, the prototype is designed to reverse-engineer software files in order to determine whether they are malicious—representing a significant advancement in the field of cybersecurity.

Read More: OpenAI may roll out low-cost ‘Go’ ChatGPT plan ahead of GPT-5 launch

According to a detailed blog post from Microsoft, Project Ire is able to conduct a complete analysis of a software file even when it has no background information regarding the file’s origin or intended function. The system relies on a sophisticated toolkit—including decompilers and behavioural analysis tools—to inspect code, understand its operations, and decide whether it poses a security threat.

The project is the result of a collaborative initiative between Microsoft Research, Microsoft Defender Research, and Microsoft Discovery & Quantum teams.

To ensure transparency and reliability, Microsoft has embedded a mechanism within Project Ire that generates a “chain of evidence”—a detailed, step-by-step explanation of how the AI agent arrives at its verdict. This not only enables human experts to later review and verify the decision but also introduces accountability, particularly in cases of false positives or errors.

Read More: OpenAI urges students to see ChatGPT as learning aid, not answer shortcut

Project Ire’s evaluation begins by identifying the type and structure of the file, after which it reconstructs its control flow using reverse-engineering tools like Ghidra and angr. From there, it leverages various APIs to summarise the function of each code segment, all of which are appended to the chain of evidence.

To test its robustness in practical scenarios, Microsoft challenged the AI agent with nearly 4,000 complex files—all of which had previously bypassed other automated analysis tools and were awaiting manual expert review. Under these stringent conditions, Project Ire achieved a precision score of 0.89 and a false positive rate of just 4%.

Most notably, Project Ire became the first system—human or AI—within Microsoft to build a case strong enough to justify the automatic blocking of an advanced persistent threat (APT) sample. That threat has since been neutralised by Microsoft Defender.

Read More: WhatsApp bolsters security with new anti-scam features