A GitHub project called REA lets AI agents take apart native binaries, apps and websites the way a human reverse engineer would, except in minutes instead of months, and it has racked up more stars in a week than most startups see in a year.
On October 6, the open-source project morluto/rea had fewer than 10,000 stars on GitHub. By October 14, it had 234,477, according to tracking site OSSInsight, with 58,512 forks behind it. The project gained roughly 90,000 stars in a single 36-hour stretch between October 12 and October 14. That is not normal growth for a developer tool. It is the kind of curve usually reserved for a new foundation model or a viral consumer app, not a command-line utility built for disassembling other people's code.
REA stands for Reverse Engineer Anything, and the name is not much of an exaggeration. It is an MIT-licensed MCP server, built in TypeScript and shipped as the npm package rea-agents, now at version 6.5.0. It plugs into AI coding agents: Claude Code, Codex, Cursor, Gemini CLI, OpenCode, and a handful of other MCP clients. It hands them the ability to inspect native binaries, Electron and JavaScript apps, .NET assemblies, Android APKs, firmware, SQLite databases, live websites and browser behavior. Under the hood, it orchestrates tools reverse engineers already trust: Ghidra for headless disassembly, Hopper with automated setup, and IDA Pro through an MCP bridge.
Before REA, reverse engineering a compiled binary meant opening it in Ghidra or IDA, reading raw disassembly or decompiled pseudocode function by function, and manually piecing together what a program does without its source. That is slow, specialized work. People spend years getting good at it.
REA does not replace those disassemblers. It feeds their output to an AI agent in structured form. That lets the model trace a call graph, test a hypothesis about what a function does, and explain its reasoning down to the instruction level, all through a natural-language prompt instead of a GUI click-through. The analysis itself runs locally on the user's own machine.
AI reverse engineering turns GTA 5 and Halo into browser games overnight Rockstar's publisher Take-Two killed the playgta5.com browser port within hours of its October 6 launch, while a separate Modern Warfare 2 runtime called IW4L burned 200 billion tokens in its first month alone. - how to play GTA 5 in your browser - reverse engineering AAA games for web browsers
The project's documentation is explicit about the intended uses: security research, malware and incident response analysis, vulnerability research tied to coordinated disclosure, CTF competitions, debugging your own software, and interoperability work, according to coverage from AlternativeTo and ByteIota. That framing matters, because the tool is dual-use by design, and its own creators know it.
The part that makes security teams nervous #
Reverse engineering has always cut both ways. The same skill that lets a malware analyst figure out what a piece of ransomware does on a victim's machine also lets an attacker figure out how a piece of commercial software enforces its license check. REA just makes that skill available to anyone who can type a sentence into Claude Code or Cursor, instead of to the smaller pool of people who spent years learning Ghidra.
Reporting from Geeky Gadgets and KuCoin's news desk both flagged the same tension. REA has legitimate uses in security assessment and code recovery: that much is real. But its rapid spread also raises real concerns about piracy and IP theft, since the same workflow that maps a malware sample's behavior can map a competitor's proprietary application just as easily. Developers have already used it to reverse-engineer game logic for unofficial ports and to reconstruct Adobe-style creative tools without access to the original source, according to that same coverage.
For a publication that has spent the past week writing about AI agents breaching live company systems during their own security testing and reading confidential records nobody noticed missing, REA fits an uncomfortable pattern. It is not an attack tool on its own. But it collapses the time and skill cost of a step that used to be a meaningful barrier. And barriers that used to slow down bad actors matter, even when the tool itself is built with good intentions.
For the security research side, the upside is real and immediate. Vulnerability researchers can triage an unfamiliar binary in an afternoon instead of a week. Incident responders can get a first read on what a malware sample is doing without waiting for a specialist with deep Ghidra experience to free up.
That is a genuine gain for defenders. It is also the reason REA's own documentation leads with coordinated disclosure and incident response rather than with piracy.
What happens next depends less on REA's code than on who adopts the workflow first. Defenders racing to triage threats faster, or everyone else racing to see what else can be taken apart now that the skill no longer gates the access.
An AI agent that reverse engineers any software just hit number one on GitHub REA, an open-source toolkit from developer morluto, hit GitHub's trending page with over 10,400 stars after its October 7 launch, arriving days after CrowdStrike tied ARTEX to breaches at seven South Korean banks. - AI agent reverse engineers compiled software - open source GitHub trending decompile tool
Also read: TypeSafe's Jev becomes the fastest-adopted model in Vercel AI Gateway history • Disney hires the Character.AI boss it once threatened to sue • India's cyber agency says AI agents read confidential files without permission
This article is posted in AI News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.