Reverse engineering means working out how a program works by examining the program itself, without its source code. It has always been possible, because what reaches your machine is the whole program. What held it back was labour: researchers describe the work as "complex and time consuming", and it takes experts.
In October 2026 a free, open-source tool called REA, published by a pseudonymous GitHub account, went to the top of GitHub's trending list. Its makers say it gives an AI agent the tools to inspect a program and explain what it does (the project site, the repository). Those are the project's claims. Nothing here was run by us.
Security people have a name for protection that rests on what it costs an attacker: the work factor. Saltzer and Schroeder's 1975 paper gives the example of a short password, fine when guesses are typed by hand and weak against a computer. MITRE lists reliance on security through obscurity as a weakness. When effort gets cheap, protection that was only effort goes with it.
Three limits hold. Code that runs only on a company's servers never reaches your machine. The reading can be wrong: the project's own disclaimer says results "may be incomplete or incorrect". And the law has not changed: see EU Directive 2009/24/EC and 17 U.S. Code section 1201. Licences and local rules still apply to what you analyse.