REA's 100,000-star GitHub surge signals reverse engineering is getting radically cheaper

A niche skill goes viral

An open-source project called REA, short for Reverse Engineer Anything, has turned one of security research's more obscure skills into a mainstream spectacle. According to an analysis published on dev.to, REA went from fewer than 10,000 GitHub stars on October 6 to more than 100,000 by October 12, with over 30,000 arriving in a single day. By the time the author finished writing, the repository showed roughly 296,000 stars and 74,800 forks.

What REA actually is

Reverse engineering means working out how a finished program behaves without access to its source code. It traditionally demanded specialist tools — decompilers and debuggers such as Ghidra, which the NSA released publicly in 2019, along with IDA and Hopper — and days of patient work per feature. As dev.to explains, REA is an MCP server that connects AI coding agents such as Claude Code or Codex to those same professional tools, plus Chrome DevTools for web and Electron apps. A user states a goal in plain language and the agent investigates and reports back.

Two caveats temper the hype. Projects like GhidraMCP and IDA Pro MCP had already linked AI to these tools for about a year, so REA's real novelty is making the connection easy enough for ordinary developers to try. And REA's own README is modest, disclaiming any ability to recover original source code or clone applications automatically.

The cost curve is the sharper signal. The UK's AI Safety Institute reported in April that GPT-5.5 solved a reverse engineering challenge in about ten minutes for roughly $1.73 — a task that had taken human professionals around twelve hours.

The ArtCraft test case

The project that pushed the story into wide view is ArtCraft, built by developer Brandon Thomas, who on October 3 announced free, open-source Rust rebuilds of Adobe's applications and followed with Word, Excel and PowerPoint equivalents on October 7. His stated motive was frustration with Adobe's cancellation fees; dev.to notes that Adobe settled with the US government for $150 million in March over alleged hidden early-termination fees while denying wrongdoing.

The specifics, however, undercut the easy narrative. Thomas says he used plain Claude Code rather than REA, and that his repositories explicitly bar the AI from examining or disassembling the originals, permitting only the study of behavior, public file-format specifications and appearance — the classic clean-room method. The output is also rough: the dev.to piece cites misbehaving Smart Objects, crashes when importing many video clips, and only 5 of 30 filter tests matching Photoshop's results, with one pixel artist calling the Photoshop clone unusable. Thomas has already abandoned a promise of full parity within a month. In a test reported by MindStudio, a Mac app rebuilt once with REA and once from screenshots alone both worked, and the screenshot version finished first.

Security cuts both ways

The same capability that speeds up cloning speeds up defense. Work that took a skilled analyst half a day — analyzing a suspicious binary, understanding malware, auditing closed-source software — now takes minutes. But attackers receive the identical speedup. As dev.to argues, vendors have long been able to assume that few people would ever comb through their machine code, an assumption that quietly excused weak binary-level protections. That assumption is now failing.

Rights holders are already reacting. Activision pulled a video of an AI-reverse-engineered Modern Warfare 2, and Bethesda sent a cease-and-desist over an AI-generated browser game based on Fallout.

The legal ground is unsettled

Under EU trade-secrets law, reverse engineering a product you bought is allowed, and functionality itself is not protected by copyright even though code is; decompilation is permitted only under strict interoperability conditions. In the US, courts have found fair use in some disassembly cases (Sega v. Accolade) and in copying API declarations (Google v. Oracle). The unanswered question, as dev.to frames it, is whether a language model trained on enormous amounts of public code counts as "clean" under a clean-room doctrine — a dispute previewed earlier this year by a Claude-driven rewrite of the Python library chardet. Vendors, meanwhile, are updating contracts to ban AI-assisted reverse engineering.

Record AI lobbying — roughly $130 million in US federal spending during 2025, per Bloomberg Law, with OpenAI, Anthropic and Meta sharply increasing outlays in 2026 according to the Financial Times and Axios — is aimed, per the dev.to analysis, at shaping rules around data centers and model testing rather than at responding to cloning tools.

Why it matters

The star count is a demand signal: when a capability falls in cost by orders of magnitude, it does not stay confined to specialists. Defenders should assume their binaries are readable and audit accordingly; vendors can no longer lean on lock-in and cancellation friction; and the legal system has yet to decide whether AI-assisted clean rooms are clean at all. The practical takeaway from the ArtCraft episode is measured — within days, anyone can now produce a lookalike that opens, edits and exports files, but not one dependable enough to bet a professional workflow on. Both halves of that situation are new.