Pseudonymous Software Engineer Morluto Creates AI Reverse-Engineering Tool REA, Enabling Ordinary Users to Deconstruct Device Proprietary Software
An exclusive conversation with REA developer Morluto in Scientific American. Morluto argues that the ability of AI agents to orchestrate decompilation tools transforms software reverse engineering from a tedious task for a few experts into an operation accessible to ordinary users. The article also presents warnings from a law professor at Cornell Tech regarding crises in trade secret and copyright law, as well as concerns from open-source developers about security risks.
For decades, software manufacturers have enjoyed a sense of security derived from tedium: dismantling compiled programs was so exhausting that almost no one bothered. But this packaging also kept users out of the inner workings of their own devices. If you buy a new car, you can repaint it or swap the wheels, but you are not allowed to modify the control code for the dashboard display and other electronics. In an exclusive interview published by Scientific American on October 30, 2026, a software engineer using the pseudonym Morluto viewed these restrictions as a challenge. His tool, REA (Reverse Engineer Anything), allows AI agents to autonomously orchestrate decompilation programs, restoring binary code into human-readable source code, and then reassembling it according to the user's wishes.
The technical principles behind REA are not mysterious. Before a program runs, its code must be compiled into binary—a long string of 0s and 1s that instructs the computer on how to operate. Reverse engineering involves reversing this translation, converting binary back into human-readable code during the decompilation process. Previously, reverse engineers manually performed this work using tools such as Ghidra, developed by the U.S. National Security Agency. REA provides the pipelines that allow AI agents to call upon Ghidra and other decompilation programs independently. "Reverse engineering is somewhat like pattern matching, and AI possesses extremely strong reasoning and pattern-matching capabilities," Morluto said.
The lowering of barriers is the core change highlighted in this article. Zion Basque, an assistant professor at the University of Georgia who studies reverse engineering, noted that before 2026, decompilation was the domain of a select few experts; now, nearly anyone can participate. His research team developed Kuna, one of the decompilation tools that REA can equip AI agents with. James Grimmelmann, a law professor at Cornell Tech at Cornell University, stated that completing such tasks manually would require experts months of work, if they could manage it at all; the current limitation is simply how many tokens you can afford. "If you have the tokens, you can set it loose on almost any piece of software."
The diffusion of this capability is shaking up legal frameworks. Grimmelmann believes that copyright protects the program's code but not the algorithms and ideas implemented by the code. "This opens up a world of mods, remixes, and interoperable new clients, significantly shortening the lead time people gain from deploying software." He warned, "This will pose a crisis for trade secret and copyright law."
For ordinary users, this capability means gaining control over the devices they have purchased. Joey Castillo, an open-source developer and technologist in residence at Cornell Tech at Cornell University, previously attempted to modify a smart ring he bought in Shenzhen, China. He discovered that AI models could not only reverse-engineer the ring but also teach him the entire process simultaneously. "I learned a lot just by watching Claude work," he said. Castillo attributed this desire to tinker with a need for control over items he had bought: "I bought this object, and it is being gatekept from me. Now I want to make it do what I want."
However, some barriers exist for important reasons. While AI excels at breaking into security systems, it is also very adept at disrupting digital rights management and protected firmware within devices. Castillo and his open-source peers worry that people will meddle with devices without fully understanding them. "All of this will be very fun until someone vibe-codes firmware and causes a battery to catch fire mid-flight," Castillo said. He doubts that AI models possess the foresight that reverse-engineering experts bring when deciding which modifications to make, because AI "can only say 'yes, and,' not 'no, but.'"
Platform-level restrictions have already emerged. Since Morluto's initial interview with Scientific American, social media users have reported that OpenAI and Anthropic banned or blocked their use of REA. An OpenAI researcher responded on X, stating that the block on reverse engineering was "mostly accidental." However, Castillo already has alternatives: the open-weight model GLM-5.3 from the Chinese company Z.ai. "Once downloaded, no one can take it away," he said. "If Anthropic and OpenAI decide to ban my account, I will launch GLM-5.3 to reverse-engineer that smart ring, because I think it’s really cool to make this thing do what I want."
Morluto is not concerned about these obstacles. In his view, the tech industry is full of walled gardens, and AI has made "their walls not as robust as they thought." He repeatedly mentioned tech founders who shaped his work—Steve Jobs of Apple, Jensen Huang of Nvidia, and Paul Graham of Y Combinator. "Many creators in the past were hackers, tinkers, and experimenters growing up," he said. He believes REA can turn users into that kind of creator. "You can not only perform magic but also create beautiful things." Regarding the core of REA, Morluto said, "It is a path that guides you to question what you truly want."