What Happens When AI Makes Reverse Engineering Cheap

Two weeks ago, reverse engineering was a niche skill that security researchers put on their resumes. This week, it's the most popular thing on GitHub.

A project called REA (short for Reverse Engineer Anything) went from under 10,000 stars on October 6 to over 100,000 by October 12, with more than 30,000 of those on a single day. As I write this, its repo shows about 296k stars, 74.8k forks, 718 open issues, and 478 pending PRs. In the same week, one developer released free, open-source clones of Photoshop and Premiere, and then Word and Excel.

I have read this point multiple times in different tones and senses: "Software is done." Is it?

I spent 3 days reading through the coverage, the legal analysis, and the lobbying filings. The honest answer is that it's less dramatic than the hype, and more important than the skeptics think.

Reverse engineering means working out how a finished program works without access to its source code. It used to take specialist tools (decompilers, debuggers) and days of patient work per feature.

REA is an open-source MCP server that connects AI coding agents like Claude Code or Codex to those same professional tools, such as Ghidra (released publicly by the NSA in 2019), IDA and Hopper, plus Chrome DevTools for web and Electron apps. You describe what you want in plain language ("figure out how this app's search works and show me the evidence"), and the agent investigates and reports back.

Two details are worth knowing before you repeat the hype:

Meanwhile, the UK's AI Safety Institute reported in April that GPT-5.5 solved a reverse engineering challenge in about ten minutes for roughly $1.73. Human professionals had needed about twelve hours for the same one. That's not about REA, but it shows where the cost curve is heading.

The project that put this on everyone's radar is ArtCraft, built by Brandon Thomas. On October 3 he announced free, open-source Rust rebuilds of Adobe's apps, then followed with Word, Excel and PowerPoint equivalents on October 7. His stated motive was frustration with Adobe's cancellation fees. (Adobe settled with the US government for $150 million in March over allegations about hidden early-termination fees, while denying wrongdoing.)

The details matter more than the headline:

So a clone that opens, edits and exports can now appear in days. A clone you'd trust with your livelihood still can't.

1. Security research gets faster. The same capability that lets someone clone an app lets defenders analyze suspicious binaries, understand malware and audit closed-source software. Work that took a skilled analyst half a day now takes minutes. That's a real gain, though attackers get the same speedup (more on that below).

2. Pressure on pricing and lock-in. If a credible free alternative can appear within weeks, vendors can't rely on feature lock-in or cancellation friction. Buyers gain negotiating power, and the next license renewal looks different when an open-source option exists.

3. Preservation and interoperability. Reverse engineering has a long, respectable history: Phoenix's clean-room rebuild of the IBM PC BIOS in 1984 made PC clones possible, and Samba and Wine exist because of it. AI makes that work accessible to individual hobbyists. People are bringing orphaned and console-only games to new platforms, though that edge is where the legal trouble starts.

4. It rewards what's actually hard. If copying features becomes cheap, defensibility moves to data, integrations, reliability, support and trust. That's arguably healthier than competing on how long it takes to read machine code.

1. Piracy and takedowns. The same tools that port games also help people break copy protection, and studios are reacting. Activision pulled a video of an AI-reverse-engineered Modern Warfare 2, and Bethesda sent a cease-and-desist over an AI-generated browser game based on Fallout. Creators who thought they were doing a fan project found out otherwise.

2. Fewer places for vulnerabilities to hide. For decades, "nobody will bother reading our binary" quietly protected sloppy security. That protection is eroding. For defenders it's a chance to fix things; for attackers it's a faster way to find them.

3. The legal ground is unsettled. In the EU, reverse engineering a product you bought is allowed under trade-secrets law, and functionality itself isn't protected by copyright, though code is.

Decompilation is only allowed under strict interoperability conditions. In the US, courts have found fair use in some disassembly cases (Sega v. Accolade) and in copying API declarations (Google v.

Oracle). But there's a question nobody has answered: a classic clean room separates a human who reads the original from a human who writes the copy. A language model trained on enormous amounts of public code isn't obviously "clean." Earlier this year, a rewrite of the Python library chardet with Claude sparked a dispute over relicensing.

As one lawyer put it, independent reimplementations may be defensible, but expect litigation once someone with deep pockets is affected.

4. Contracts are changing. Software vendors are updating their terms to ban AI-assisted reverse engineering and competitive benchmarking, and enforcing licenses harder. How enforceable those clauses are is still disputed, but the trend is clear: cheaper copying means more monitoring and more lawyers.

This is where I want to be careful, because the story most people tell is tidier than the evidence.

It's tempting to say "companies are scrambling for AI regulation because of tools like REA." I couldn't find evidence of that link. What the filings do show is a record amount of money going into Washington:

In other words, the lobbying is mostly about which rules get written (and avoiding a patchwork of fifty state regimes), not a panicked reaction to open-source cloning. There's also a December 2025 White House executive order pushing federal AI standards and aimed at limiting state regulation, and the pro-regulation side has its own well-funded groups.

Cloning is getting its own, quieter response: takedown notices, tightened terms of service, and lawyers. The thing worth watching is that none of this was designed with AI-driven reverse engineering in mind. The rules we have were written for a world where reading machine code was hard.

As a frontend developer, I don't think software is over. What's over is the idea that having built the screens is a moat. The hard parts of a product (edge cases, accessibility, performance under real use, years of compatibility) are exactly what the clones still struggle with. If anything, this raises the bar for what's worth building.

What I'd actually take from this mini research:

The tool changed. The legal and ethical questions didn't, and they're about to get a lot of testing.

I would like to know: What’s your take on AI reverse engineering? Is AI-assisted reverse engineering a gift to defenders, a gift to pirates, or both? Tell me in the comments.

I'm a Senior Frontend Engineer working on accessible, high-performance web apps. I write about what I learn as I build. You can find me on LinkedIn, GitHub and my Portfolio.