The GNU strip backdoor is the case AI code review can't see

The GNU strip backdoor case highlights a crucial distinction between AI code review and artifact provenance. According to a recent paper on arXiv (arxiv 2607.24888), the trust problem of compiler-specific attacks like Ken Thompson's cannot be solved by AI alone. The researchers demonstrate that GNU strip, a build utility that does not read source code but manipulates finished ELF binaries, can be compromised at the binary level.

In the NixOS bootstrap process, a malicious strip in the binary seed can implant a payload that propagates through subsequent strip generations and survives in the final standard environment, even after the original seed has been removed. This poses a significant challenge for AI code review tools, as they primarily focus on reading patch text and source code, but do not examine the build path or binary seed.

The authors argue that this issue is not simply a limitation of current AI models, but rather an inherent flaw in the review process itself. Even when presented with the most powerful reasoning models, they are unable to detect malicious code that has been embedded in the final binary artifact. This occurs because the malicious code is not present in the source code at all, but rather arrives as a finished strip binary in the dependency closure.

The paper illustrates the need to separate two distinct tasks: verifying the integrity of the source code and ensuring that the artifact run by users matches the reviewed source. While AI excels at identifying bugs or flaws in the source code, it cannot confirm whether the deployed binary has been tampered with during the build process. This represents a different trust problem, which the authors refer to as "strip-trust" rather than "compiler-trust."

For organizations adopting AI code review, the authors recommend a clear distinction between these two tasks. AI should be utilized for the first job—assessing the validity of the source code—but not relied upon to guarantee that the final artifact matches the reviewed source. Relying solely on the model's approval of a code diff can lead to a false sense of security, with the strip-trust problem often going unnoticed beneath the surface.