What was done
Codex (gpt-5.4) and Claude Code (Opus 4.6) used Binary Ninja over MCP to triage a publicly documented 'Staatstrojaner' DLL; a structured case-file workflow recovered its command dispatch and protocol layer.
Where the human stepped in
The agents missed the hard-coded C2 server and the embedded key and reported the wrong AES key size. Results vary between runs, so output is treated as an intermediate state for an analyst to continue.