Something shipped this week that has a lot of people in software and AI talking. On October 7, an open-source project called REA, short for "Reverse Engineer Anything," hit GitHub and went straight to the top of the trending page, with nearly three thousand stars in its first day and more than ten thousand a couple of days later. It's a toolkit that hands a coding agent the keys to decompilers and binary analysis tools. Point it at a native binary, an Electron app, a .NET assembly, an Android APK, or a piece of firmware, and the agent will decompile it, trace how a feature works, and help you recreate that logic in your own stack. It runs locally, and setup is a single command.
Reverse engineering has been around as long as software has. The change this week is the price, and even more than the price, the time. This used to take a rare specialist, a real budget, and weeks or months of patience. The cost kept most people out, but the delay was doing the real protective work: by the time anyone had taken your product apart, you had shipped two more versions of it.
That head start is gone. What took a team a quarter now takes an agent an afternoon. The horizon has been absolutely flattened.
// If Anyone Can Take It Apart, What Is It Worth?
That's the question I keep coming back to. If anybody can reverse engineer any app, what makes your app valuable? And what mechanisms do we imagine for protecting IP from here on?
I think this is the first thing I've seen that might actually scare enterprise companies in their forward pursuit of using AI for everything. Until now the corporate anxieties about AI have been about productivity, headcount, and keeping up. This one is different. If your IP isn't safe, that's the destruction of capital. That's stock prices, and behind the stock prices, people's livelihoods. The same technology a company is racing to adopt is the one that makes its crown jewels readable.
// The Regulation Question
So I can imagine a conversation starting very quickly, and out in the open, about how we regulate these models. It's worth noticing that the frontier labs, OpenAI and especially Anthropic, have been asking for regulation for a while now. They can see what's coming and they understand where their own software is taking us.
But is regulation even fruitful here? If we regulate only in the US, we've done nothing about the open-weight models coming out of other countries, the ones you can download and run on your own machine with nobody watching. Those models get more capable every few months and more competitive with the frontier labs. A rule that binds a handful of American companies doesn't bind a file on someone's hard drive. And the tool itself is open source and runs locally by design. There is no choke point to regulate.
// The Death of the Local Binary?
If companies want to keep using AI and also keep their IP, the landscape of software is going to change, and severely. The obvious move is to stop shipping the valuable part. Keep the logic on a server you control, send the customer a thin client, and there's nothing interesting left on their machine to decompile.
That was already the natural progression of software. This is going to accelerate it. I wouldn't be surprised if we look back on this as the point where shipping a full binary to a customer's machine started to look reckless.
Even then, the cloud won't fully protect anyone. You can't render all software from a data center. Games, creative tools, drivers, firmware, anything that has to work offline or respond in milliseconds: these need local code for many reasons. And a server only hides the implementation. The behavior is still sitting there in plain view for anyone who wants to rebuild it, which is its own kind of cheap and fast now. So what is the point of closing your software if it can be opened anyway?
// The Customers Who Were Waiting for This
Here's the part I find more interesting than the threat. Think about how some of these companies have treated the people paying them. Adobe built a subscription that was hard enough to cancel that the FTC took them to court over it. Sony has spent years pushing toward an all-digital world where what you "buy" is a license that can be changed or taken back. The message is that even if you paid for our software, you don't own it.
That posture only works when the customer has no alternative. And AI, especially local AI, is democratizing the software industry in a way I haven't seen before. The customer who feels trapped now has options that didn't exist a year ago: understand the thing they paid for, make it talk to something else, or have a replacement built by someone with a weekend and an agent.
Obscurity bought every software company a head start, measured in money and mostly in time. Both just collapsed. What's left is whether your customers would want to leave if they could.
// Build a Great Thing
So at the end of the day, I think the way you stop yourself from being reverse engineered and replaced has less to do with software than we'd like. It's about how you treat your customers. It's about how you think about your product and how thoughtful you are about your implementation. Nobody goes to the trouble of cloning a product they're happy paying for, from a company they trust, that keeps getting better faster than a copy could.
The companies that should be nervous this week are the ones whose retention strategy was the exit being hard to find. If you're building a great thing and treating people well, a decompiler doesn't change much for you. If you're abusing your customers, you're probably in for a bad time.