AI Still Can't Reliably Reverse JavaScript Obfuscation
The claim that AI has killed client-side code protection is premature. Obfuscation remains a cheap, effective deterrent that raises the cost of reverse engineering, and the tooling is already adapting with AI-resistant techniques.
A practical test feeds obfuscated JavaScript into an AI tool and compares the output against the original code. The restored result is far from the original — variable names, control flow, and logic remain scrambled. Multiple code samples produce the same poor outcome.
A newer category of "anti-AI reverse JS encryption" adds another layer specifically designed to resist LLM-based deobfuscation. Tests on these hardened samples show AI tools fail to recover anything close to readable source.
The conclusion is blunt: JS obfuscation still works. AI cannot simply "crack" obfuscated code back to its original form. Even if it could, forcing an attacker to run an AI pipeline is still a higher bar than shipping plaintext source.
The rumor that AI makes obfuscation useless confuses "can produce some output" with "can produce correct output." AI tools generate plausible-looking but functionally wrong code from obfuscated input.
Obfuscation is entering an adversarial cycle: as LLMs get better at pattern matching, obfuscators add transformations designed to exploit LLM weaknesses, such as misleading semantic cues.
The practical security bar is not whether AI can theoretically deobfuscate code, but whether the cost and accuracy of doing so make it worthwhile for an attacker.
The discussion pushes back on the article's framing. The real goal of reverse engineering obfuscated JavaScript is rarely full source restoration; it's targeted extraction of critical logic, function signatures, and parameters. A second point argues that obfuscation techniques like pervasive array indirection remain effective against AI, which may grasp isolated semantics but cannot reconstruct a coherent project structure.
The point of cracking JS isn't to restore the code—it's to extract key functions, parameters, etc... to get what you need.... [laugh]
Use arrays throughout the entire code; let's see how it restores that. Of course, some code semantics can still be immediately recognized by AI, but it just can't recover an engineering project.