On October 12, 2026, a GitHub repository called REA picked up 52,186 new stars in a single day, more than most open-source projects collect across their entire lifetime. A star is a one-click bookmark, not a measure of code quality, but the rate of them is a decent proxy for attention: by November 11 the repository sat at more than 450,000 stars and 110,000 forks, according to GitHub’s own count on the morluto/rea page.
REA's star rush, then fade Daily new GitHub stars added to morluto/rea, 2026
| | New stars per day (stars/day) |
|---|---|
| Oct 4 | 1,373 | | Oct 5 | 3,625 | | Oct 9 | 19,375 | | Oct 10 | 26,572 | | Oct 12 | 52,186 | | Oct 13 | 50,912 | | Oct 20 | 11,286 | | Oct 31 | 3,217 | | Nov 8 | 2,724 | | Nov 11 | 665 |
Source: Trendshift. Daily gains, not cumulative totals; growth took off in early October 2026 and has slowed since. REA stands for Reverse Engineer Anything. Posted under the handle morluto, it hands an AI coding agent the job of taking apart software or hardware it has never seen the source for: decompiling native binaries, Android and Electron apps, .NET assemblies, even whole websites, by orchestrating existing tools like the disassembler Ghidra and writing up what it finds in plain English. As Jason Koebler reported for 404 Media, the tool turned AI-assisted reverse engineering into something close to a one-line prompt.
People used it to take back devices they already owned. REA’s community unbricked internet-of-things gadgets their manufacturers had abandoned, stripped surveillance ads out of smart TVs, turned baby monitors into general-purpose AI assistants, and loaded new operating systems onto hardware a decade or more old. None of it required touching REA’s own code: pointing Claude Code or OpenAI’s Codex at a device and asking it to decompile the firmware worked almost as well on its own.
The crackdown #
That stopped working within weeks. Users on Reddit’s r/ClaudeCode forum and in the Reverse Engineer Anything Discord reported Claude Code triggering “safety checks” mid-task and refusing to keep decompiling. On Codex the penalty was steeper: the X user log4j, who had been reverse-engineering Samsung TVs, said OpenAI banned the account outright for violating its policy on “cyber abuse.” Other users who asked Codex to reverse-engineer their own hardware, or even their own code, reported warnings or account restrictions on the same grounds.
A GitHub issue filed against the Codex CLI shows this wasn’t limited to hobbyists chasing a Reddit trend. One user enrolled in OpenAI’s Cyber Trusted Access program, doing authorized penetration testing on their own devices, got an automated “Cyber Abuse” warning with no in-app notice and no detail on what triggered it; an appeal came back denied with no further review offered. Other commenters on the same thread described identical flags for routine system administration, among them credential rotation and DNS configuration. OpenAI’s own cyber-safety documentation, quoted in the thread, concedes its classifiers are still being calibrated and can misread legitimate administrative work as an attack.
An OpenAI account posting under the handle roon, in a message that 404 Media and other outlets attributed to the OpenAI engineer Tarun Gogineni, called the blocks unintentional: “these blocks are mostly accidental and a result of difficult decision boundaries; there is no prohibition against reverse engineering with codex. it’s getting fixed.” The GitHub issue, filed weeks earlier with the same complaint, had no comparable fix logged as of its latest update.
Matt Brown, principal consultant at Brown Fine Security and a longtime hardware hacker, told 404 Media his blocks tracked almost exactly with the labs’ “cyber” content category. “My general experience about reverse-engineering getting blocked has been more or less 100% correlated with the ‘cyber’ category blocks I have received,” he said. “My take is that the lab[s] are probably under pressure to not have their models take part in some kind of criminal hacking activity and their cyber guardrails are erring on the side of being too strict.” Brown’s response was to stop depending on the frontier labs. He used GLM 5.3, an open-weight model from the Chinese lab Zhipu AI, to reverse-engineer the mobile app paired with an internet-of-things gas monitor his propane supplier had installed, and found hidden Bluetooth commands that silently switch on the device’s cellular modem. “I am investing in hardware and trying to stay up to speed because the frontier labs guardrails will randomly change without warning on the same model,” he said. “For my security research and pentesting work I really don’t want to invest tooling and energy into an ecosystem that will eventually lock me out.”
Why vendors are scared #
The restrictions follow, by about a month, a paper that predicted exactly this fight. In “Cheap AI-Assisted Reverse Engineering and What It Will Do”, researchers from Cornell Tech, Columbia University and NYU, Ilan Mandel, Madiha Zahrah Choksi, Joey Castillo, Sebastian Benthall and James Grimmelmann, argue that reverse-engineering law assumes a cost that AI has removed. “AI systems can identify hardware components, extract firmware, decompile object code, and clone entire apps,” they write. “The resulting struggle between technology vendors and reverse engineers will challenge a wide range of laws, including trade secret, copyright, anti-circumvention, computer misuse, and contract.”
Grimmelmann put the stakes more bluntly in an interview with Scientific American:
This is going to pose a crisis for trade secret and copyright law.
The mechanics are straightforward. Copyright protects a program’s literal code, not the ideas or algorithms it implements; trade secret law has always let a competitor reverse-engineer a rival’s product, so long as the competitor puts in real effort of its own. Both doctrines relied on that effort being expensive enough to deter casual copying. An AI agent that decompiles a binary for the price of an API call removes the deterrent without changing a word of the statute. What’s left, per the paper, is pressure on the legal levers that don’t depend on cost: anti-circumvention rules under the DMCA, computer-misuse statutes, and the contract terms buried in a EULA nobody reads.
Collateral damage #
The fallout reached communities with no connection to REA. Decomp.wtf, a tool that let anyone point an AI agent at a game they owned and have it reconstruct readable C code one function at a time, shut down days after the Codex and Claude restrictions began; its creator wrote that the wider decompilation community objected to AI doing that work, and that the project would rather close than keep going against that objection. That followed, by about a month, the shutdown of decomp.dev, the field’s largest progress tracker, whose administrator blamed not AI itself but a wave of low-effort forks racing to top its public leaderboard.
The same economics are now reaching cameras. The YouTuber Breno, who has documented vibe-coded firmware for decade-old DSLRs and compact cameras, argues manufacturers have a direct financial stake in blocking exactly this kind of work: “Camera companies have this practice of keeping features to release on newer cameras, and having distinctions [in features] in camera lines. This is breaking that from those big companies, which are going to lose a lot of money if this becomes a big thing.”
The science-fiction writer Bruce Sterling summarized the asymmetry on social media: “This vibe-code hacking is only called ‘reverse’ when somebody who lacks a trillion dollars is doing it. When you ‘reverse engineer’ the entire Internet Common Crawl, you just built a nice AI model.”
OpenAI and Anthropic are, separately, facing a Federal Trade Commission subpoena over AI agents accused of breaking into systems they weren’t authorized to touch, a regulatory inquiry that gives both companies reason to err toward blocking anything that resembles hacking, regardless of the user’s intent or ownership of the device. REA’s own growth, tracked daily by Trendshift, has already cooled from a peak of 52,186 new stars on October 12 to 665 on November 11. That could mean the trend is fading, or it could mean it has moved somewhere a star count can’t follow: onto local, open-weight models that don’t file a Cyber Abuse report on anyone.