- Reading compiled software got fast. The decompiling tools go back to 1991; what changed is that agents now do the slow reading, and OpenAI reports GPT-6 Astra solving 88% of a reverse engineering test at the first try.
- The tools are free and spreading. Reverse Engineer Anything went from about 40 GitHub stars to more than 116,000 between 2 and 12 October 2026, and its README suggests using it on features you want in your own product.
- Anything shipped inside an app can be read. Anthropic's threat report for September 2026 describes one attacker group decompiling 1.8 million Android apps to harvest credentials left in the code.
- Courts haven't changed course. Looking inside software you bought is usually fine. Publishing its code, cracking its locks or, in the US, ignoring a licence you agreed to is what lands people in court.
- Fans will remix what you own and revive what you abandon. Brands need a policy for fan projects and a plan for the day a product's servers switch off.
The video version, presented by our co-founder Kurt Loy. 11 min 10 sec. Watch on YouTube
- 0:00Minecraft running inside Skyrim
- 0:51Reverse engineering, explained
- 2:54Universal Modder and AI game mods
- 5:09Saving dead games and gadgets
- 7:05No more hiding: AI and security
- 8:32Is reverse engineering legal?
- 10:06What's still secret
Most brands ship more software than they realise: a loyalty app, a booking flow, a campaign microsite, a branded game, a product that talks to the cloud. All of it reaches customers as compiled code, and until recently very few people could read that code. In September and October 2026, AI agents made reading it a job almost anyone can start.
This is the written version of the video above, for brand and marketing teams working out what it means for the products they put in customers' hands. The figures come from the projects' own repositories, security reports and court records, each with a date, and the sources are at the end.
What is AI reverse engineering?
AI reverse engineering is getting an AI agent to explain a finished program when its source code isn't available. The agent operates the usual decompiling tools, makes sense of their output, and then describes, edits or recreates the program's behaviour.
Developers write apps as source code, full of names and notes a person can follow. Before the app reaches a customer, a compiler turns it into machine code for the processor, and the notes and most of the names are thrown away. Decompilers try to turn that machine code back into something readable, and they are old tools. IDA dates from 1991, and the NSA made its own decompiler, Ghidra, free to the public in 2019. Their output is thousands of functions with numbered placeholder names, and working through it took specialists days or weeks. That tedium was most of the protection. Agents now do the reading, and they don't get bored.
REA's website includes a small, careful example. Its agent picked out the routine in DX-Ball, a Windows game from 1996, that shifts sound between the left and right speakers depending on where something is on screen. It rewrote the routine in C, compared it with the original across 3,205 test cases and recompiled it to the identical 63 bytes.
What are REA and Universal Modder?
They are the two free tools that made the story spread in early October, one aimed at apps and one at games.
| Tool | What it does | Where it came from |
|---|---|---|
| Reverse Engineer Anything (REA) | Lets coding agents like Claude Code, Codex or Cursor operate decompilers such as Ghidra and IDA, and tells them how. MIT licence | First commit April 2026, three points on Hacker News in July, then about 40 to 116,122 GitHub stars from 2 to 12 October |
| Universal Modder | Skills that turn a coding agent into a modder for PC games you own. It identifies the engine, backs up your saves, reads the code, builds one feature, generates the art and tests the result in the game | Released on 30 September 2026 by Rehan Sheikh, a former engineer at the AI company fal, who announced that every game is now moddable |
REA's README names one commercial use plainly: if you see a feature in an app that you want in your own product, ask your agent to investigate it with REA. For a brand, that describes a competitor studying your app, and it starts with a free install.
The models matter more than either tool. Two YouTube creators compared agents using REA against agents without it, and the ones without it reached the same answers. In one head-to-head, plain Codex took 6 minutes against 10 with REA, and spent 1.5 million tokens against 5 million. OpenAI reports that GPT-6 Astra solved 88% of SRE-Bench, 262 programs built to resist analysis, at the first try, and 99.2% within four tries, a run made with unlimited budget and the safety checks switched off. Anthropic has gone the other way with Claude Opus 5.5, which blocks requests to find security holes in compiled programs.
Universal Modder comes with rules. It stays away from online games that use anti-cheat, from cheats that target other players and from copy protection. On 7 October someone posted a version with those limits stripped out.
What can AI read in your app?
Everything that ships to the customer's device, including any password, key or hidden setting left inside it. Code that stays on your servers is out of reach.
A security researcher who posts on YouTube as Low Level showed how fast this has become. He wanted to hunt for bugs in a Dell monitor he owns. Its firmware comes encrypted inside Dell's updater, and opening it up normally took him a day or two, sometimes a week. He gave an AI agent a two-sentence prompt. About 16 minutes later it had found the key inside the updater, written a script to decrypt the firmware and confirmed the result. The model was GLM-5.3, an open model from the Chinese lab Z.ai, not Claude or GPT. He put the fault on Dell's design, because the same key shipped to every customer.
Attackers already work this way at scale. Anthropic's September 2026 threat report describes a group that downloaded 1.8 million Android apps, decompiled them and searched them for credentials left in the code. Those credentials were how it first got in for most of its confirmed breaches. The report says security through obscurity is no longer viable, and that "sophisticated attacks no longer require sophisticated attackers."
The principle is old. In 1883 the Dutch cryptographer Auguste Kerckhoffs set out the rule that a cipher must remain safe even when the enemy has the machine. Software that hid its secrets in compiled code broke that rule for a long time and mostly got away with it, because reading the code was slow.
Defenders get the same boost. Mozilla used Anthropic's Claude Mythos Preview to find 271 vulnerabilities, all fixed in Firefox 150 in April 2026, and Bobby Holley, Firefox's CTO, wrote that "defenders finally have a chance to win, decisively."
For a brand team, the working rule is to treat anything inside an app, a microsite's scripts or a connected product as public. Keys, discount logic, admin settings and unreleased campaign material belong on a server. For devices, the researcher suggested keeping the key in hardware that software can't read out.
Is it legal to reverse engineer an app?
Generally yes, when the copy was obtained lawfully and the aim is to understand it or to build something compatible with it. AI hasn't moved those lines. The lawsuits come from publishing decompiled code, cracking encryption or anti-cheat, and, in the US, ignoring a licence the person agreed to. We're a creative studio, not a law firm, so read this as a summary of the public record and not as legal advice.
| If someone does this to your product | Usually allowed? | The case or law people cite |
|---|---|---|
| Takes it apart to learn how it works | Often, in the US, where courts have treated it as fair use | Sega v. Accolade (1992), Sony v. Connectix (2000) |
| Decompiles it to make their own product work with yours | Yes in the EU and UK, within limits, and your contract can't forbid it | EU Software Directive 2009/24/EC, Articles 6 and 8; UK Copyright, Designs and Patents Act, sections 50B and 296A |
| Ignores your licence's ban on reverse engineering | Risky in the US, where courts have enforced such bans | Bowers v. Baystate (2003), Davidson v. Jung (2005) |
| Publishes your decompiled code | No | Take-Two's suit against the fans behind the re3 and reVC rebuilds of GTA III and Vice City, dismissed in April 2023 on undisclosed terms |
| Breaks your encryption | No | Nintendo's $2.4 million judgment against the makers of the Yuzu Switch emulator, March 2024 |
The EU and UK rules add one more limit: what someone learns can't be used to build a program that is substantially similar in its expression. Learning from your app is allowed, but reproducing its code isn't.
Two questions remain open. We haven't found a court ruling on whether an agent that clicks "I agree" during an install binds the person who sent it. And in the US, code an AI produces on its own may carry no copyright at all, a gap we covered in ArtCraft vs Adobe.
What should brands do about fan mods of their products?
Decide in advance which fan projects you'll welcome and which you'll stop, because AI has made them much quicker to build. Game publishers have already shown both approaches.
The October wave mixed other companies' worlds freely. Minecraft showed up in Elden Ring on 29 September, then in Skyrim the next day, in a clip watched more than 2.6 million times by 12 October. Other clips put Spider-Man into Batman: Arkham Knight and dropped Skate 3's skateboarding into Call of Duty: Modern Warfare 2 and World of Warcraft. Where the code is public, Claude appears in most of the commit histories. Universal Modder's own examples took a day or two each, from a new Age of Empires II civilisation called the San Franciscans, with a Robotaxi unit and a technology named Move Fast and Break Things, to Minecraft running inside GTA V.
The results play worse than they look. Kotaku tried the Skyrim mod, fell through the ground after mining about two blocks, and wrote: "I did not have a lot of fun with it!" A lot of it also leans on people's slow, manual work. The Skate 3 project thanks one person who spent over two years taking the game apart by hand, and when a member of REA's team used agents to finish a fan group's rebuild of a Touhou game, the group called people making AI ports grifters and took the project private.
Publishers are answering in both directions. The maker of an AI-built Fallout fan game says Bethesda sent a cease-and-desist, and Activision had footage of an AI-decompiled Modern Warfare 2 taken down. Rockstar went the other way in 2023 and brought in Cfx.re, the team behind FiveM, which GTA roleplay servers run on. Fan creation can also be a business. Roblox paid its creators $1.503 billion in 2025, up 63% on the year before, and Counter-Strike and DotA both began as mods of other companies' games.
The same pressure reaches brands outside gaming. Fans will put your characters, products and logos into places you didn't plan for, and they'll do it faster than before. A written policy on fan projects, with a named contact for people who ask, is easier to apply than deciding case by case after a clip goes viral.
What happens when you switch a product off?
Someone may well bring it back. AI makes reviving abandoned games, apps and gadgets far cheaper, and regulators have started asking companies to plan for the end.
According to a 2023 study by the Video Game History Foundation, 87% of classic games released in the US before 2010 are out of print. Developer Chris Lewis decompiled the Nintendo 64 game Snowboard Kids 2 over 596 days, bringing in Claude only for the later stretch, then decompiled the original Snowboard Kids in 84 days with agents doing most of the work. Lewis cautions that AI doesn't explain the whole gap. His native PC, Mac and Linux release, Snowboard Kids: Recompiled, came out on 2 October 2026.
Hardware is getting the same second life, though neither of these two examples is known to have used AI. After Google cut app support for its early Nest thermostats on 25 October 2025, volunteers started a replacement-firmware project on GitHub eight days later. When Humane switched off the servers behind its AI Pin in February 2025, the PenumbraOS project rebuilt the missing server so the pin's software had something to talk to.
Regulators are paying attention. The Stop Killing Games petition gathered 1,294,188 verified signatures asking the EU to keep games people paid for playable once support stops. The European Commission answered on 16 June 2026 that it couldn't propose that obligation at this stage. It will instead open talks on an industry code of conduct for the end of a game's life by the end of 2026, and it pointed out that providers must already tell consumers, before they sign up, how long the contract runs and how it can end. In the US, a copyright exemption lets players circumvent the protection on a game they own once its login servers close, for their own play.
If you sell a connected product or an app that depends on your servers, write the end-of-life plan before launch: what keeps working offline, what you'll release when the servers close, and what customers are told when they buy.
What's still secret?
Anything that never leaves your servers. REA only sees code that lands on the user's device. On a website, that's whatever the browser downloads, never the code running on the server. When the US Copyright Office refused an exemption for researchers studying AI systems in October 2024, it said the real barrier wasn't copyright law but "third-party control of closed SaaS systems".
That moves the advantage to what a copy can't take. Seema Amble at a16z argued in May 2026 that "the defensible data is not the data you import; it's the data your product uniquely causes to exist." For a brand, that means the customer relationship, the service around a product and the trust behind the name, the same conclusion we reached about software features in our piece on ArtCraft's Adobe clones.
What we'd do now
Our advice for brand and marketing teams, as of October 2026:
- Assume anything inside your app, microsite or connected product can be read, and keep keys, discount rules and admin settings on a server.
- Ask whoever builds your apps to check every release for passwords and keys left in the code.
- Write a fan-project policy before the next viral mod uses your characters or products.
- Plan the end of life for anything that depends on your servers, and tell customers before they buy.
- Put your effort into what a copy can't take: your customer data, your service and the trust behind your name.
We'll update this page if a court rules on AI decompilation or the big publishers change their mod policies.
Frequently asked questions
What is AI reverse engineering?
It's getting an AI agent to explain a compiled program when you don't have its source code. The agent operates decompilers such as Ghidra or IDA, interprets what they produce, and describes, edits or recreates the program's behaviour. Reading that took specialists days or weeks now goes much faster: in one case an agent found a firmware key in about 16 minutes.
Can AI reverse engineer any app?
No. Agents can only work on code that has been delivered to a device, and server-side code never is, so it stays private. The US Copyright Office made the same point in 2024 about closed online systems. Protection still slows agents down too: OpenAI's best benchmark result on deliberately protected programs needed four attempts.
Is it legal to reverse engineer an app?
Usually, if you obtained the copy legally and you're studying how it works or making something compatible with it. Lawsuits follow when someone publishes decompiled code, breaks encryption or anti-cheat, or, in the US, breaks a licence they accepted. EU and UK law also stops contracts from overriding the right to decompile for compatibility. Treat this as general information, not legal advice.
Can a competitor copy my app with AI?
They can study how its features work, and REA's own README suggests doing exactly that. Copying or publishing your code, or building something substantially similar in its expression, is where the law usually draws the line. Because features are now easier to imitate, your service, your customer data and the trust behind your brand count for more.
How do I protect my app from AI reverse engineering?
Assume everything inside the app can be read. Keep keys, passwords and business rules on your servers, and for devices, store keys in hardware that software can't extract. Check each release for credentials left in the code, since one attacker group decompiled 1.8 million Android apps looking for exactly that.
What is Reverse Engineer Anything (REA)?
REA is a free, open-source tool (MIT licence) that hands coding agents like Claude Code, Codex or Cursor the controls of decompilers such as Ghidra and IDA. It had roughly 40 GitHub stars on 2 October 2026 and over 116,000 ten days later. In public tests, agents without REA solved the same tasks.
What is Universal Modder?
A free bundle of agent skills for modding PC games you already own, published by Rehan Sheikh on 30 September 2026. It steers clear of online games that use anti-cheat and of copy protection, but a version with those limits stripped out was posted on 7 October.
Are AI game mods legal?
Publishers often tolerate single-player mods of games you own. They act when a project publishes their code or breaks encryption or anti-cheat, and some have moved against AI projects: Bethesda reportedly sent a cease-and-desist over an AI-built Fallout fan game. Others embrace modders, as Rockstar did by bringing in the FiveM team in 2023.
Sources
We checked every figure against these sources on 12 October 2026. GitHub stars and view counts change daily, so check the date on anything you quote.
- The tools: REA repo, DX-Ball case study, Show HN, July 2026, lustoykov, Codex with and without REA, Nick Saraev, with and without REA, Universal Modder repo, Rehan Sheikh's launch post, Hex-Rays on 30 years of IDA, Ghidra
- Models: OpenAI on GPT-6 Astra, SRE-Bench paper, Claude Opus 5.5 system card
- Security: Low Level on the Dell monitor, Anthropic threat report, September 2026, Mozilla on Firefox 150
- The law: Sega v. Accolade, Sony v. Connectix, Bowers v. Baystate, Davidson v. Jung, EU Software Directive 2009/24/EC, UK CDPA section 50B and section 296A, TorrentFreak on Take-Two and re3, Nintendo v. Tropic Haze docket
- Mods and publishers: chasm's SkyCraft video, SkyCraft repo, Kotaku, 2 October, SK8-ENGINE README, the Touhou reconstruction, Kotaku on Bethesda and Activision, GameSpot on Rockstar and FiveM, Roblox FY2025 annual report
- Preservation: Video Game History Foundation, 2023, Snowboard Kids in 84 days, Snowboard Kids: Recompiled, Google on the Nest thermostats, NoLongerEvil, PenumbraOS, EU reply to Stop Killing Games, US exemption, 37 CFR 201.40
- What's still secret: US Copyright Office, 2024 recommendation, a16z, Is Software Losing Its Head?
- Original post and video: Kurt Loy, AI can reverse engineer apps and games now