Reverse engineering apps with AI: what has been rebuilt, how it works and what comes next

Reverse engineering apps with AI means using agents to understand how a program works without its source code and, sometimes, to rebuild it. The real cases from October 2026 (REA, ArtCraft, GTA V on iPhone), how it works step by step, the legal risks and what it means for software, agencies and companies.

Reverse engineering apps with AI means using AI agents to understand how a program works without its source code and, in some cases, to rebuild it from scratch. In October 2026 it stopped being specialist work: an open tool, REA, went from fewer than 10,000 to more than 100,000 GitHub stars in six days, and a developer released free apps in the style of Photoshop or Premiere written with Claude. Our thesis: whatever you can see in a piece of software can now be described, and whatever can be described, AI can put back together.

Think of a music box. It used to take a watchmaker and months behind a loupe to make another one. Today it is enough to listen closely to the melody, draw the blueprint and hand it to a tireless workshop. The melody did not change; the cost of copying it did. And that moves the ground under any company that sells software, or uses it to sell.

What is reverse engineering apps with AI?

Reverse engineering means starting from the finished product to learn how it was made. It is an old practice: it is used so two systems can talk to each other, to audit security, or to maintain old programs nobody documented. What is new is who does the heavy lifting. AI agents such as Claude Code or Codex can now operate the professional tools of the trade, read the compiled program and explain in plain language what each part does.

There are two paths, and they should not be mixed up. The first looks inside: the agent analyzes the installed file (the binary) with decompilers such as Ghidra or IDA. The second looks from the outside: you watch the app working, write a detailed description of its behavior and build something new that does the same without touching the original code. That second path is called a clean room rebuild.

Which apps have already been rebuilt or analyzed with AI?

These are the verifiable cases from the last few weeks, with sources at the end of the article. None of them is an opinion: they are posts by the authors themselves or by outlets that documented them.

• REA (Reverse Engineer Anything): an open tool that connects agents such as Claude Code, Codex, Cursor or Gemini CLI to analysis programs such as Ghidra, IDA, Hopper, JADX and Apktool. It covers desktop binaries, Electron apps, .NET, Android APKs and websites. According to Decrypt, it had fewer than 10,000 GitHub stars on 10/06 and more than 100,000 on 10/12; on 10/14 the project page showed more than 235,000.
• ArtCraft: developer Brandon Thomas released free, open apps written in Rust that mirror Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign and Acrobat. He says he wrote them with Claude Opus 5.5 and that they are a clean room rebuild, with no Adobe code and without REA. His site lists 13 apps, all in early alpha or in development (PetaPixel, 10/07; Decrypt, 10/12).
• GTA V on iPhone: user C22 posted the game running on iOS on 10/09, one of the examples Decrypt ties to this wave of AI-assisted analysis.
• Fable 2 on PC: in late September an unofficial port of the Xbox 360 game was released, built through recompilation. According to DSOGaming, AI got it booting in about an hour; a lot of manual work followed, and you need your own copy of the game to play.
• The owners' response: Bethesda sent a cease and desist over Fallout: New York, an AI-made browser game, and its author took it down on 10/04. Activision had footage of an AI-decompiled Call of Duty: Modern Warfare 2 pulled (Decrypt, 10/12).

What it is not yet: None of these cases is a perfect clone. REA's own README says it does not promise to recover original source code or to clone an application automatically. ArtCraft promised Adobe parity in a month and later revised it to months, and users pointed out its image editor is not yet usable for real work. The speed is real; the maturity is not there yet.

• 100,000+, REA GitHub stars: From under 10,000 on 10/06 to over 100,000 on 10/12 (Decrypt).
• 13, ArtCraft apps: All in early alpha or in development according to getartcraft.com, checked on 10/14.
• 8 of 10, Vulnerabilities found: By an AI agent in an unprotected app; 0 in the protected one (Thales, 10/01).
• 970x, Cost for the attacker: More tokens spent against the protected version, close to seven hours (Thales, 10/01).

How does it work, step by step?

Here it is without jargon, the way we would explain it to a sales director. It is the same path we follow when we deploy agents in a company: the agent does not guess, it works on evidence and every step can be reviewed.

• 1. Observe: use the app and record everything it does. Screens, buttons, files it opens and saves, data it sends over the internet.
• 2. Read inside (when appropriate): the agent asks a decompiler to translate the installed program into something readable and walks through it function by function, like someone tracing the wires of a switchboard.
• 3. Write the specification: everything above becomes a document that describes what the program does, not how it is written. That is the music box blueprint.
• 4. Rebuild: another agent writes a new version from that blueprint. In a clean room, that second agent never sees the original.
• 5. Verify: both programs are compared with the same tests. Where they differ, you fix it. People are still needed here: this is the step that separates a demo from a product.

What changed in 2026 is not the theory, which is decades old. It is the cost of steps 2 to 4. They used to take months for an expensive team; today they take days for an agent that does not get tired, as long as someone with judgment sets the direction and reviews the result.

Is it legal to reverse engineer an app?

It depends on the country, the license and the use, and it is not something to decide based on an article alone. What we can say with judgment: rebuilding without copying code does not clear you of everything. The terms of use of many apps expressly forbid reverse engineering; a product's brand, name and look are also protected; and some features may be patented. Experts who reviewed ArtCraft point to exactly those risks, and note that nobody has independently verified that the process was truly clean.

REA says so in its notice: it is meant for lawful research, interoperability, preservation and analysis of software you own or are authorized to examine. Legitimate uses for a company exist and are valuable: understanding an in-house system nobody documented, migrating off an old platform, getting two programs to talk, or auditing the security of your own app. Copying someone else's product to sell it is not one of them. When in doubt, a lawyer before an agent.

What happens next? Our outlook

The enemy is not AI that copies. It is a habit: believing that what protects a software business is that nobody knows how it is built. That secret is becoming transparent. What comes next, on three fronts:

For software companies

Features stop being a barrier. If your edge is a button nobody else has, that edge lasts as long as it takes someone to describe it. Defense moves to what cannot be seen from outside: the data you accumulate, integrations with your customers' systems, how fast you change, service and trust. Expensive subscriptions for mature products will feel pressure from free alternatives that, even half-finished, are enough for many users. And a new protection market is growing: on 10/01 Thales launched a layer to make installed code harder to analyze with AI.

For agencies

A development agency's value stops being writing code and moves to three things: understanding what needs to be built, describing it precisely and verifying that it works. It is the difference between the person who types and the one who draws the blueprint. Agencies that keep billing by the coding hour will compete against an agent; those that sell judgment, specification and results will use that agent as their best tool. At MAMBO we already work this way.

For companies that use software

A concrete opportunity opens up: that internal system nobody dares to touch, built by a vendor who is gone and with no documentation left, can now be understood and modernized. The same goes for expensive tools where you use 10% of the features: building your own, tailored, is no longer a year-long project. The flip side: your app, your customer portal or your configurator can also be observed and copied by a competitor.

What to do if you run a company or an app

• Assume your interface is public: anything a user sees, an agent can describe. Do not keep keys or sensitive business rules in the installed app; keep them on your server.
• Invest in what cannot be copied by looking: your own data, customer relationships, integrations and speed of improvement.
• Use it in your favor first: document your legacy systems with AI and audit your own app before someone else does.
• If you ship installable software, evaluate binary protection and review your terms of use and trademark registrations.
• Before analyzing third-party software, read the license and talk to your lawyer. The tool is new; intellectual property rules are not.

If you want to apply this in your company, from documenting an in-house system to building a custom tool with agents, we do it with method and with legal judgment.
AI implementation at MAMBO
Web development at MAMBO
AI implementation in companies: a practical 2026 guide
Getting started with Claude Code
What an MCP is: Claude Code with the Meta Ads MCP
The first model we need to change is our own

Frequently asked questions

What is REA (Reverse Engineer Anything)?

It is an open source tool, MIT licensed, that works as an MCP server and a command line. It connects AI agents such as Claude Code or Codex to analysis programs such as Ghidra or IDA to inspect binaries, Electron apps, .NET, Android APKs and websites. The analysis runs on the user's own computer.

Can any app be cloned with AI?

Not automatically or completely, not yet. The October 2026 cases show prototypes that partly work and need a lot of human effort to become a product. And even if it were technically possible, copying someone else's app can infringe copyright, trademarks, patents or terms of use.

What is a clean room rebuild?

It means rebuilding a program without looking at its code: one team, or agent, describes the behavior and a different one writes code from that description. It is a known industry practice, but on its own it does not guarantee the rebuild is legal.

How do I protect my app from AI reverse engineering?

Do not leave secrets in what gets installed, keep sensitive logic on your server, evaluate binary protection tools such as the one Thales launched on 10/01/2026 and, above all, build advantages that cannot be copied by looking: data, service and integrations.

Is AI reverse engineering useful for a company that does not sell software?

Yes, for legitimate uses: understanding and documenting inherited in-house systems, migrating platforms, connecting tools that do not talk to each other, or auditing the security of your own applications.

Is your business's melody in the mechanism anyone can draw, or in something nobody can hear from the outside?

Sources and scope

Data checked on October 14, 2026. GitHub star counts change daily; ArtCraft and REA are under active development. This article is not legal advice.
REA on GitHub (README and legal notice)
Decrypt: From GTA V on iPhone to Free Photoshop (10/12/2026)
PetaPixel: Photoshop, Premiere and Lightroom style apps built with AI (10/07/2026)
ArtCraft: app list
C22: GTA V on iOS (10/09/2026)
Chris First: Fallout: New York taken down (10/04/2026)
DSOGaming: unofficial Fable 2 PC port
Thales: Sentinel Envelope Plus (10/01/2026)