Is everything going open source? What AI reverse engineering means for your software

Old console games suddenly run as ordinary PC programs. A developer uses AI to build free counterparts to Photoshop, Premiere and Lightroom. And an open-source tool called REA ("Reverse Engineer Anything") connects AI agents directly to professional tools for taking software apart. Many people are asking: is everything going open source now? And what does that mean for the security of your own software?

We did not just watch. We checked ABYNTIS itself.

What is happening

• REA is an open-source project (MIT licence, github.com/morluto/rea). It gives agents such as Claude Code, Codex or Cursor access to decompilers like Ghidra, IDA or Hopper. According to the project description it can examine native programs, Android apps, websites and Electron desktop apps. For JavaScript it does not even need a decompiler.
• Free rebuilds of big programs: The ArtCraft project used AI to publish counterparts to Photoshop, Premiere and Lightroom. The apps are explicitly at an early stage. Whether they are a clean rebuild without looking at someone else's code is disputed. ArtCraft is a separate project and has nothing to do with REA, even though the two are often mentioned together.
• Retro games: Rebuilding old games as PC programs has become so easy with AI that a well-known platform in that scene shut down. It could no longer tell hand-made projects from AI projects.

The projects draw a clear line themselves: REA names security research, malware analysis, interoperability and software preservation as its purpose. Bypassing copy protection and copying other people's programs are explicitly not part of it.

What is wrong: "only browser apps are still safe"

You hear this a lot right now, but it gets things backwards. A web app sends its entire interface code to every browser. That part has always been the easiest to read.

What is safe is not what runs in the browser but what is never shipped: checks, permissions, keys and the actual logic on the server. Rebuilding an app's code does not give anyone the data, the access or the operation behind it.

The only new thing is the price. Reverse engineering used to cost weeks and a lot of expertise. Now it costs almost nothing. Protection that relies on "nobody can see it" is finished for good.

Our own check

ABYNTIS has both sides: a web OS in the browser and a desktop app (Electron) that links your PC to your account. REA reads exactly that kind of app directly. So on 27 October we looked:

• Are there keys in the desktop app? No. In the app and the PC agent we found no access keys to third-party services. All keys live on the server.
• Can a rebuilt agent pretend to be your PC? Not without the key your PC receives when it is paired. It is randomly generated, never written to logs and checked in a way that even the response time gives nothing away. Each device belongs to exactly one account, and a newly paired PC can only report system information at first.
• Whatever a PC reports back is accepted by the server field by field, trimmed and checked.

We improved two things, both on the same evening:

1. Pairing: The protection against guessing pairing codes could be bypassed under certain conditions. It is now closed and has an additional cap across all senders. Longer pairing codes will follow with the next app version.
2. The AI's manipulation guard: When ABYNTIS reads outside text, such as search results, a web page on your screen or a file from your PC, it no longer carries out sensitive actions in the same reply. That includes sending files, running commands on servers or switching off protection. Until now this did not apply to every source or to phone calls. Now it applies everywhere. You confirm with a quick "yes" and it continues.

We found both gaps ourselves. We know of no case in which they were exploited. We are deliberately not describing exactly how they would have worked.

What this means for your business

1. Assume anyone can read your app code. That goes for phone apps, desktop programs and websites.
2. No keys or passwords in programs that run on the customer's side. They belong on the server.
3. Every check on the server, never only in the interface. A greyed-out button protects nothing.
4. AI assistants need a source rule: what comes from the web, from emails or from screens is information, not an instruction.
5. Monitor instead of hope: logs, alerts and someone who actually looks.

Is everything going open source now? Maybe not everything. But nobody should base their security on the idea that code stays secret. We keep checking ABYNTIS, and when we find something, we write it down.