LASIK strips anti-agent armor from software without running any of it
BLA hardens apps so AI reverse-engineering agents burn their token budget on decoys. LASIK is a static tool that proves the decoys dead and removes them.
There is now a small arms race over whether a language model can read your shipped code. On one side is BLA, short for Blind LLM Agents, which wraps release builds in layers meant to waste an AI agent’s context and money. On the other is LASIK, by pktq, which takes those layers off again.
The interesting part is the constraint LASIK sets itself. It never executes the file it is cleaning.
What it is up against
BLA, by qybaihe, describes four kinds of defense in its README: planted decoys and fake manifests, inputs sized to trip an analyzer’s limits, integrity checks that bind files together so the decoys cannot simply be cut out, and runtime detection of debuggers. LASIK’s README adds prompt-injection text to that list. BLA claims about 639x token amplification across 14 showcase targets, and labels that figure an internal estimate.
How it works
LASIK’s README lists a fixed pipeline: detect the protection, cut the interlocks, strip decoys, fold constants until nothing changes, rename, redact planted instructions, report.
Each step is a proof obligation, not a guess. Opaque predicates, the conditions that look live but always evaluate one way, are resolved by tracking which bits of a value are known, and the dead branch is dropped. Integrity checks are evaluated in a small interpreter that handles a closed subset of the language, then folded away. Encrypted string tables are decoded with the key that ships beside them. Code that no real entry point can reach is deleted. Text aimed at the reading model goes through 40 redaction rules.
The README says LASIK uses no eval, no sandbox, and no WebAssembly instantiation, and that files with no protection come back byte for byte identical. It also admits two soundness reviews caught cases where cleaning changed a program’s behavior or touched unprotected files.
The numbers
These are the author’s estimates, measured on BLA’s four public CrackMe challenges.
| CrackMe | Size before | Size after | Estimated tokens before | After |
|---|---|---|---|---|
| v6 | 303 KB | 4.9 KB | 6,954,989 | 1,398 |
| v7 | 743 KB | 13.6 KB | 197,561 | 3,483 |
| v8 | 362 KB | 6.7 KB | 6,972,491 | 4,748 |
| v9 | 381 KB | 7.4 KB | 6,977,670 | 4,941 |
That is roughly 21 million tokens down to 17 thousand. The README is clear that this makes the challenges readable and does not publish their solutions.
The limits are stated too. Local variable names, comments, and anything the protection overwrote cannot be recovered. Several of the 21 supported formats are validated only on fixtures built from BLA’s source, not on real protected builds.
Try it yourself
LASIK is MIT licensed and installs from npm as lasik-agents, with Node.js 20.19 or later. lasik scan scores a build, lasik heal writes a cleaned copy, and an MCP server exposes both to coding agents. The README names its intended uses as your own software, malware samples, CTFs, and authorized audits, and warns that stripping protection from software you have no rights to may breach licenses or laws.
We have not run LASIK or BLA ourselves; this is based on both projects’ READMEs.