AI Reverse Engineering: Did REA Really Clone Adobe?

No. The developer who built the free Adobe and Microsoft Office clones publicly refused to use REA, the AI reverse engineering tool he is constantly credited with using. He said on 12 October 2026 that his team does not decompile commercial software and does not permit tools like Ghidra, because he fears copyright litigation if the output reproduces proprietary code.

Those are the two biggest software stories of the month, and most coverage has fused them into one. They are closer to opposites. The gap between them is not a detail, it is the entire legal question, and anyone deciding what this means for their own product should start there.

Written by Abdul Wahab, Co-Founder and CEO of Codeatic. Technical review by Usama Tariq, Co-Founder and CTO. Reviewed 20 October 2026. We have not run REA against any commercial product, and nothing here is a hands-on review.

On this page

• What REA is, and what it does
• Did REA build the Adobe and Office clones?
• How good are the clones, really?
• Is AI reverse engineering legal?
• What it means if you sell software
• Why the clones stall at 45 percent
• Frequently asked questions

What is REA, and what does it actually do?

REA is an MCP server that lets an AI coding agent inspect software it did not write. Its own tagline is "one MCP for reverse engineering across binaries, applications, and runtime behavior." Your agent calls REA, REA inspects the target, traces the code and returns findings with the evidence attached. Analysis runs locally.

The repository is morluto/rea. It passed 248,000 GitHub stars earlier in October, 327,000 by 19 October, and sits at 342,900 stars with 86,500 forks as of 20 October 2026. That is one of the fastest climbs the platform has seen, and it is the reason the story reached people who have never opened a terminal.

It works with Claude Code, Codex, Cursor, Gemini CLI and Grok Build, which is why this is genuinely an AI agent story rather than a security tools story. It handles native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, websites, firmware and packet captures. Deep native analysis still needs Ghidra, Hopper or IDA installed alongside it, plus Node 22 or later, so this is not a one-click product for non-technical users whatever the coverage implies.

The README is more restrained than almost everything written about it:

REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.

It also states plainly that REA "does not claim to recover original source code or automatically clone an application." That single sentence contradicts most of the headlines about it.

Did REA build the free Adobe and Office clones?

No, and the person who built them went out of his way to say so. Brandon Thomas, an Atlanta engineer with 15 years in the industry who has written Rust for about a decade, built ArtCraft: PhotoCraft and PdfCraft against Adobe, then WordCraft, DeckCraft and GridCraft against Word, PowerPoint and Excel. He used Claude Opus 5.5 and Rust. Decrypt states directly that ArtCraft is not built with REA.

Thomas describes his method as clean room. His team works only from publicly available file format specifications and observed behavior, never from decompiled binaries, and he does not allow Ghidra anywhere near the project. That is not squeamishness. It is the specific legal structure that gives a reimplementation a defense, and using REA would have destroyed it.

The same conflation runs through the viral modding projects attributed to REA, the Spider-Man build inside Batman Arkham City, the Minecraft items in Elden Ring, the GTA V iOS port posted by developer C22 on 9 October 2026. Decrypt notes that for most of these, the REA connection is the framing of the article rather than a stated fact. REA is real, it is enormous, and it is being credited with work it did not do.

Thomas is not an uninterested party, and his clean room claim is his own. Andres Guadamuz, who reads intellectual property law at the University of Sussex, has pointed out that nobody outside the project knows how much of the code Claude wrote versus Thomas, and that we "do not know whether the claimed clean-room process stands up to scrutiny." Both things can be true: his method is the right one on paper, and it is unverified.

How good are the clones, really?

About 45 percent production ready, by the project's own assessment. This is the part that gets lost between the headlines and the stock move, and it is the most useful number in the whole story.

ArtCraft's first commit was 30 September 2026. In roughly 10 days it accumulated 1,152 commits and 1,004 merged pull requests, with 10 to 20 AI agents working in parallel. The surface is genuinely impressive: PhotoCraft opens and saves PSD files, nearly all 256 test files opened without issue, and WordCraft covers 458 of 475 catalog commands.

Then the measurements get specific. Only 133 of those 256 files matched the original at pixel level. Only 5 of 30 filter test cases matched Photoshop's rendering. WordCraft's DOCX support has, in the team's own words, never been tested on real world files, and its East Asian typography is self-rated at 25 percent. The team estimates PhotoCraft needs another 1,100 to 1,800 Opus 5.5 agent hours to reach beta and 2,300 to 4,100 for parity. Thomas originally promised full feature parity within a month and has since revised that to months. One pixel artist who tried the Photoshop clone called it "completely unusable."

Markets moved anyway. On 13 October 2026 HSBC cut Adobe from Buy to Hold and lowered its price target from $310 to $267, citing competitive risk from ArtCraft. Adobe's Creative Cloud runs $779.99 a year upfront or $69.99 a month on an annual plan, so the threat of a free substitute is worth pricing even when the substitute does not work yet. An Adobe engineering director had said about 2 months earlier that rewriting all of Photoshop is "nearly impossible."

Is AI reverse engineering legal?

Reverse engineering for interoperability has survived court challenges, but a license agreement you clicked can ban it anyway, and that is where most people get this wrong. Three strands decide it, and AI changes none of them.

The first is clean room design, the method Thomas claims. One team examines the original and writes a specification of what it does without reproducing code, a lawyer reviews that specification, and a separate team that has never seen the original implements from the specification alone. Phoenix Technologies used exactly this to reimplement the IBM BIOS in 1984, and NEC v. Intel in 1990 was the first US trial to accept the argument. It defends against copyright because it establishes independent creation. It does not defend against patents.

The second is fair use. In Sony Computer Entertainment v. Connectix, 203 F.3d 596, the Ninth Circuit held in 2000 that disassembling Sony's BIOS object code was necessary to understand its behavior and was permitted, partly because the BIOS contained unprotected functional elements. So decompilation is not inherently unlawful.

The third is the one people forget. In Davidson & Associates v. Jung, 422 F.3d 630, the Eighth Circuit held in 2005 that a clickwrap license prohibiting reverse engineering was enforceable under state contract law, and that the defendants had not made out the DMCA's interoperability exception. You can have a fair use argument and still lose on the contract you agreed to at install.

Add the DMCA's anti-circumvention rules under section 1201, where the Copyright Office declined a proposed AI security research exemption in its 2024 triennial rulemaking, and the honest summary is that this is a genuine grey area that predates AI by 30 years. What AI changed is the cost. The analysis that took a skilled team weeks now takes an agent hours, so far more people will walk into this question without knowing the question exists.

Enforcement is already visible. Activision had footage of an AI-decompiled Call of Duty: Modern Warfare 2 pulled, and Bethesda sent a cease and desist over Fallout: New York, an AI-built browser game that came down.

What does this mean if you sell software?

Your binary is now far cheaper to read than it was a year ago, so stop treating the code as the moat. That is the practical takeaway, and it does not require panic.

• Check what your license actually says. Davidson is the reason this matters. A clear prohibition on reverse engineering in your terms is a real remedy, and many small vendors have never had one drafted.
• Know what is in the binary. Anything shipped to a user's device can now be inspected at low cost, including keys and endpoints that were previously protected by obscurity. Server-side logic remains much harder to map, which is an argument for where to put the valuable parts.
• Stop selling the feature list. A feature list is exactly what an agent can reproduce. The accumulated handling of edge cases, the integrations, the support and the reliability record are not.
• Watch the headline risk, not just the product risk. HSBC downgraded Adobe over software that fails 25 of 30 filter tests. Your customers may react to the existence of a free clone long before it works.

Why do the clones stall at 45 percent?

Because AI closes the distance to software that looks finished, and barely moves the distance to software that is correct. ArtCraft's own numbers say it better than any argument: files open, and the computation inside them is wrong more than half the time.

That gap is not a failure of the model. It is what mature software actually consists of. The 123 files that did not match at pixel level and the 25 filters that rendered differently represent years of accumulated corrections, each one traceable to a real user hitting a real problem. None of that is visible in a binary, so none of it can be read out of one. It can only be rebuilt by having users and fixing what breaks.

From our work this is the single most consistent pattern in AI-assisted delivery, and it is identical to what we see in automation. Getting to a demo is fast now. Getting to something you can leave running unattended against real customer records is where the time goes, because that part is not generation, it is verification. We wrote about the same boundary in our comparison of the current crop of AI agents, and it holds here exactly.

Where Codeatic fits

We are not a reverse engineering firm and this post is not a pitch for one. What this story is useful for is calibration: if you are being told that AI can rebuild your systems or your competitor's in a weekend, ArtCraft is the best available evidence of what actually happens when a skilled engineer with 10 to 20 agents tries it on a well-documented target.

We build automations and agents for service businesses in the US, Canada and the UK, and most engagements start with a free AI audit that tells you which of your processes are worth automating and which to leave alone. For PlayFast that audit found a process running across 5 separate tools and we took it from 5 to 1. A full audit is $3,000, against the $75,000 and up the enterprise consultancies charge for the same scope.

The short version

• REA is an MCP server that lets AI agents inspect software. It is at 342,900 GitHub stars and its README says it does not clone applications.
• The Adobe and Office clones were not built with REA. Their developer refused to use it on 12 October 2026 to protect a clean room defense.
• The clones are about 45 percent production ready. 5 of 30 filter tests matched Photoshop, and 133 of 256 files matched at pixel level.
• HSBC still cut Adobe from Buy to Hold on 13 October, target $310 to $267.
• Reverse engineering for interoperability has won on fair use, Sony v. Connectix in 2000, and lost on contract, Davidson v. Jung in 2005. AI changed the cost, not the law.
• If you sell software, the binary is readable now. Check your license terms and move value server side.

How these figures were arrived at

Star counts, the tagline, the supported targets and both quoted README passages were read directly from the morluto/rea repository on 20 October 2026. Thomas's refusal to use REA and his stated reasons are reported by KuCoin's news desk, dated 12 October 2026. His background, method and the clean room claim, plus the Guadamuz comment, are from Al Jazeera, 14 October 2026. The statement that ArtCraft is not built with REA, the modding attributions and the takedowns are from Decrypt. Commit counts, test results, self-assessed readiness and agent hour estimates are from BigGo Finance, 11 to 12 October 2026. The HSBC downgrade is reported by Yahoo Finance. Case holdings were checked against the published reports for Sony v. Connectix, 203 F.3d 596, and Davidson v. Jung, 422 F.3d 630, and general background on the method against the EFF Coders' Rights reverse engineering FAQ.

Two limits worth stating. We have not installed or run REA, and no claim here is based on using it. And the quality figures for ArtCraft originate with the project itself rather than an independent test, so treat them as the most favorable honest account rather than an audit. This is a fast-moving story and every figure is dated to 20 October 2026. If you find an error, tell us and we will correct the post and note the correction.

Nothing here is legal advice. We are not lawyers, and anyone weighing a reimplementation of a commercial product should take advice from one before starting, not after.

Frequently asked questions

What is REA on GitHub?

REA, short for reverse engineer anything, is an open source MCP server at morluto/rea that lets AI coding agents inspect software without source code. It supports binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, websites, firmware and packet captures, and it works with agents including Claude Code, Codex, Cursor, Gemini CLI and Grok Build. It is MIT licensed and had 342,900 stars on 20 October 2026.

Did someone really clone Adobe and Microsoft Office with AI?

One developer, Brandon Thomas, built free open source substitutes for both: PhotoCraft and PdfCraft against Adobe, and WordCraft, DeckCraft and GridCraft against Office. He used Claude Opus 5.5 and Rust, not REA. The apps exist and are downloadable, but they are early alpha and self-assessed at roughly 45 percent production ready.

Is it legal to reverse engineer software with AI?

It depends on method and contract, and AI does not change either. Disassembly to achieve interoperability was held to be fair use in Sony v. Connectix in 2000, but a clickwrap license banning reverse engineering was upheld in Davidson v. Jung in 2005, and the DMCA's anti-circumvention rules apply separately. Clean room reimplementation from public specifications is the lower risk path, which is why ArtCraft uses it. Take legal advice before relying on any of this.

Can AI copy any app?

No. REA's own README says it "does not claim to recover original source code or automatically clone an application." Reading what software does is now cheap. Reproducing it correctly is not, and server side logic largely cannot be read from a binary at all.

Should I stop paying for Adobe or Microsoft 365?

Not on the strength of these clones. At the time of writing 5 of 30 filter tests matched Photoshop's rendering and the Word substitute's file format support had not been tested on real world documents. They are worth watching, and they are not yet a replacement for professional work.

What should I do if my own product could be cloned this way?

Three things. Make sure your license agreement explicitly prohibits reverse engineering, since that is an enforceable remedy. Assume anything shipped to a device can be read, and keep genuinely valuable logic server side. And compete on the things a binary does not contain, which is support, reliability and accumulated edge case handling.