A printer that refuses a third-party cartridge. A smart TV that stops receiving updates. A car with a dashboard feature locked behind a subscription. We may own the hardware, but who controls the software that makes it work?
That old question has acquired a new accomplice: an AI agent that can help take the software apart.
Scientific American reported on October 30, 2026 that a pseudonymous developer known as Morluto has built Reverse Engineer Anything—REA—an open-source system that lets AI coding agents direct established reverse-engineering tools. The project had surpassed 400,000 GitHub stars by the time of that report, a measure of attention rather than proof of technical reliability.
The startling possibility is not that a computer has suddenly learned to break every lock. It is that an expensive, specialized skill may be becoming more accessible to people who never studied assembly language. That could help an owner understand a device, a researcher expose a vulnerability—or a reckless user break something dangerous.
The developer challenging the black box
Speaking to Scientific American, Morluto traced the project to video-game decompilation: the painstaking work of analyzing compiled games and rebuilding their behavior. He sees the same methods extending to printers, televisions and other products filled with software. His aspiration, as quoted in that interview, is expansive: “If code is magic, then we are all capable of it.”
But that is a vision, not a verified guarantee. Morluto’s identity remains pseudonymous in the source interview, and Apep Bar has not interviewed him or independently tested REA. The interview also featured warnings from Cornell Tech law professor James Grimmelmann about copyright and trade secrets, and technologist Joey Castillo about the safety risks of poorly understood firmware changes.
What REA actually does—and what it does not
Traditional software reverse engineering can involve extracting an executable, identifying machine instructions, tracing calls, and inferring what a program does. Specialists use decompilers and disassemblers to translate portions into more readable representations. Ghidra, created by the U.S. National Security Agency and released publicly, is one well-known example.
REA’s official repository describes a coordinating layer for coding agents: it routes a task to suitable local tools, obtains assembly, pseudocode, symbols, strings or runtime observations, and gives the agent evidence to interpret. Depending on the target, those tools may include Ghidra for native binaries or JADX for Android applications. REA itself does not automatically supply every analysis engine or bypass every protection.
That distinction matters. Decompilation does not restore the original source code with the original names, comments, design decisions or complete context. Even a convincing reconstruction must be tested against what the actual program does. Encrypted, server-side or inaccessible components present different barriers. An AI-generated explanation can also simply be wrong.
An independent technical examination by CellCog on October 18 found that REA version 6.7.0 exposed 207 MCP tools, with approximately 3.16 megabytes of tool definitions. Its test underscored an unglamorous detail of the AI revolution: merely providing a vast toolbox can impose considerable context and computing overhead. The tool is not magic. It is orchestration, automation and evidence management at scale.
What the published demonstrations actually show
The strongest evidence is not the project’s name; it is a set of specific, inspectable examples published by its maintainers.
- Windows Calculator: The official project walks through the different percent-button behavior after addition and multiplication, using native instructions and Microsoft reference material to explain why 200 + 10% yields 220. This is a bounded reconstruction of a feature, not a complete rewrite of Windows.
- Aegis Authenticator: The maintainers describe tracing a time-based one-time-password generator in a released Android APK, then checking a reconstructed calculation against reference cases. Their published account reports 133 test cases plus checks against RFC 6238. These are the project’s reported tests, not an independent Apep Bar replication.
- Older games and desktop apps: Its showcased cases include a sound-position calculation in the 1996 game DX-Ball and clipboard behavior in Notion. Each involves following a limited behavior through code and comparing it to observed results.
These demonstrations support a substantial claim: AI agents can help automate meaningful software investigation. They do not establish that an untrained person can safely modify every vehicle controller, device, commercial product or protected system.
The ownership question no one can compile away
The legal stakes are larger than a coding trick. Copyright, trade secrets, license agreements and anti-circumvention law each apply differently. The fundamental tension is whether buying a device should entitle a person to understand, repair or adapt its essential code.
In the United States, 17 U.S.C. § 1201(f) provides a limited reverse-engineering exception for certain interoperability purposes, while the Copyright Office’s 2024 rulemaking established specific, temporary anti-circumvention exemptions. These are not blanket permissions to bypass every digital lock. Whether a use is lawful depends on the software, protective measure, activity, jurisdiction and other facts.
Trade secret law introduces another question: what happens when a proprietary technique can be inferred from a distributed executable? Meanwhile, competition, repair and preservation advocates may see an opportunity to replace software abandoned by its manufacturer. A product’s business model and the owner’s practical autonomy can point in opposite directions.
This extends Apep Bar’s ongoing questions about the behavior of devices after users think they are off and who gets excluded when AI-driven development meets platform rules. A right to inspect is not automatically a right to rewrite—but a system no one can meaningfully inspect is difficult to hold accountable.
The darker mirror: security, privacy and fake downloads
Reverse engineering also helps defenders audit malware, find flaws and test software claims. The same techniques can aid attackers. Easier access lowers barriers for both groups; it does not make unauthorized intrusion acceptable.
One particularly revealing warning emerged from REA’s own popularity. In October, a report filed in the official issue tracker alleged that a lookalike repository was distributing a trojan-flagged Windows executable under an apparently official REA name. The evidence is a public report of antivirus detections, not proof that every flagged file was malicious. The genuine project now explicitly directs users to morluto/rea, rea.tools or the rea-agents package, and cautions against copycat downloads.
There is a second privacy issue. REA’s analysis tools may run locally, but findings supplied to a coding agent can reach that agent’s model provider, depending on configuration and provider policy. Companies evaluating proprietary software should therefore review data handling, authorization, credentials and network exposure before connecting anything sensitive.
And a reconstructed function is not a safe firmware patch. An incorrectly changed charging controller, vehicle system or medical device could have physical consequences. AI can accelerate understanding without providing the judgment, testing or liability controls that safety-critical engineering demands. That distinction belongs at the center of the story, not in the fine print.
A gate has opened. What happens next?
The most useful way to think about REA is as an amplifier. It can help a knowledgeable analyst work faster and give a motivated novice a route into work that was once forbiddingly tedious. Its publicly documented examples are promising; its title remains a provocation, not a universal capability claim.
Manufacturers now face a difficult choice. They can treat easier inspection as a threat to intellectual property and product security, or accept that better scrutiny may produce safer, more repairable and longer-lived devices. Both arguments contain legitimate concerns.
Meanwhile, the owner of that printer, smart ring, car or television confronts the question beneath the code: when a product is yours, how much of the technology inside it should still be off-limits?
Sources and further reading
- Scientific American, Peter Hall, interview with Morluto (October 30, 2026)
- REA official GitHub repository and responsible-use documentation
- REA’s own documented case studies and checks
- CellCog’s technical examination of REA 6.7.0 (October 18, updated October 26)
- NSA Ghidra software reverse-engineering framework
- U.S. Copyright Office, 2024 Section 1201 proceeding
Editor’s note: Apep Bar analyzed publicly available reporting and project documentation. We did not interview Morluto or independently run REA. Featured image: authentic Ghidra disassembly screenshot by Philipnelson99 (March 2019), used unchanged under CC BY-SA 4.0. The image shows Ghidra, not the REA interface.
