AI Reverse Engineering and Clean-Room Rewrites: REA, PhotoCraft, chardet and Malus Side by Side

Published on October 14, 2026 by Remy
Tags: #ai-agents #ai-coding #open-source #security #developer-tools

Four stories have converged over the past two weeks. REA (“Reverse-Engineer Anything”) is a reverse-engineering toolkit for coding agents; on October 13 it gained 45,327 GitHub stars in a day, reaching 161,865, and its Hacker News thread drew 800 points and 337 comments.[1][3] PhotoCraft, the flagship of ArtCraft, bills itself as a clean-room reimplementation of Photoshop in pure Rust and had 55,400 stars on October 13.[6][8] Back in March, chardet 7.0 was rewritten from scratch with Claude Code and relicensed from LGPL to MIT (later 0BSD); original author Mark Pilgrim opened issue #327 saying the maintainers had “no right to relicense.”[11][12] That same month, the satirical site Malus turned the idea into a mock business, “Clean Room as a Service”: upload a dependency manifest, get back a “rewritten” version with no attribution and no copyleft. It scored 1433 points on HN.[16]

Together they are cross-sections of one pipeline: use an agent to understand a program (REA), turn what it learned into a spec or a test suite, have an agent rewrite from that spec (PhotoCraft, chardet), and ship it under a different license (chardet, and the target of Malus’s satire). Every step of that pipeline became cheap enough for an individual developer this year, while the law and community norms still assume two teams separated by a wall. This post covers the mechanism, compares it with the classic clean room, breaks the risk into layers, and ends with a checklist you can use.

The short version

  1. Reverse engineering is not new; the cost is. Recovering a business rule used to mean assembly, Ghidra and weeks of work. Now it takes a prompt and a few minutes, which is the scale of REA’s Calculator demo.[2]
  2. AI clean rooms usually have no wall. The classic method separates the people who read the original from the people who write code, and that separation is the evidence. In both chardet 7 and PhotoCraft, one person observes, writes the spec and reviews the code, and the model may have seen the original in training.[8][12]
  3. Low similarity proves exactly one thing. It shows literal code was not carried over. It does not show the derivative link is broken, and it says nothing about terms of use, trademarks, trade dress or patents.[8][9][13]
  4. Relicensing is the riskiest step. The same rewrite under a new package name would barely have been noticed. Keeping the old name and swapping copyleft for a permissive license is what made it a fight.[13]

What REA actually does

REA describes itself plainly: give your coding agent tools to inspect the program itself instead of guessing.[2] Targets range from native binaries to web pages and Electron apps, and the tools cover disassembly, decompilation, call tracing and capture of browser or process activity at runtime.[1] Setup is one command, npx rea-agents@latest setup, after which the agent has a set of inspection tools it can call.

The site walks through two examples, and they are worth reading closely because they show exactly where “reverse engineering” turns into “rewriting.”

The first is Windows Calculator: why does 200 + 10% give 220? REA returns the x64 instructions of the % handler from the installed Calculator DLL. The agent sees two comparisons against 0x5c and 0x5b, looks those up in Microsoft’s public source as the multiply and divide command IDs, and notes the constant 0x64, which is 100. The recovered rule: after × or ÷, 10% becomes 0.1; after + or −, 10% means 10% of the first number, so 200 + 10% is 200 + 20.[2] The second is Chromium’s dinosaur game. Through a local debugging connection REA pulls the running index.js and finds that speed starts at 6, increases by 0.001 per update and caps at 13. Calling the original update function in a controlled browser gives a speed of 10.0 after 4,000 updates and 13.0 after 10,000.[2]

In both cases, what reaches the user is not the original code but a rule, written in prose or a few lines of pseudocode. The agent then writes a new small program from that rule and checks it against the original. That is the four-step pipeline below.

From reverse engineering to rewrite (REA as example)Targetexe / DLL / JS / pageInspectdisasm · decompile · runtimeRulereadable behaviour specRebuildnew codedifferential test against the originalCalculator: 200 + 10% = 220after +, % takes a share of the first number; after × or ÷ it becomes 0.1 [2]Dino game: speed starts at 6, +0.001 per update, capped at 1310.0 after 4,000 updates, 13.0 after 10,000 [2]The Rule box decides the legal character: behaviour and facts only, or the original expression toowhether the Inspect step is allowed by the licence terms is a separate question

Figure 1: From reverse engineering to rewrite in four steps. The differential test uses the original program as the source of truth. Numbers are from REA’s two published examples[2]

Screenshot of the Hacker News thread "REA Reverse – Engineer Anything"

Screenshot: the HN thread on REA. The top comment says the retro-game decomp scene, already hit by low-effort ports, is about to be flooded with half-decent AI decomps[3]

The top HN comment is specific. Retro-game decompilation used to be a community spending years turning a game back into readable C. Now anyone with a 200-dollar-a-month subscription can mass-produce half-decent decomps, which drains the point out of the hobby.[3] Hands-on videos reach a similar verdict.[4][5]

My view is that REA is not legally more sensitive than Ghidra or Chrome DevTools. It adds no new capability; it connects existing capabilities to an agent that calls tools on its own. The real change sits in the third box of Figure 1. The “rule” used to be an understanding inside an engineer’s head. Now it is a document the agent writes, and the same agent can turn it into code in the next message. The distance between reading and writing has shrunk from weeks to a single conversation, and that distance is precisely what a clean room exists to enforce.

PhotoCraft: a clean room with no source to read

PhotoCraft is the mirror image of chardet. Photoshop is closed source and nobody claims to have read its code, so the question is not whether anyone saw the code but how much behavior was observed, and how.

According to Declic’s review of the repository, the first big commit was titled “one-shot”: 42,241 lines at once, less than three hours after the project’s first commit. By October 10 the contributors file listed 1,302 commits and 189 contributors, with Claude Opus 5.5 credited as co-author on 736 of them.[8] The goal is “1:1 Photoshop parity”: same menus, same shortcuts, same behavior. The project rules say Photoshop is studied only for behavior and appearance, no code is copied, and everything is built from public specifications (Adobe’s documented PSD format, the ICC color standards) and observation.[6][8]

The observation is thorough. The team installed Photoshop 2026 and inventoried the package without launching it: default shortcuts, plug-ins, strings from the main binary. A companion repository holds more than 250 PSD files generated by scripts that drive the real Photoshop; each embeds Photoshop’s own rendering, and tests require PhotoCraft to reproduce the same pixels. For one undocumented parameter, the team notes it read the name from the software’s internal strings.[8] The project reports 24 crates, more than 1,700 tests and PSD round-trips passing 307 of 309.[6]

Screenshot of the storytold/photocraft GitHub repository

Screenshot: the PhotoCraft repository. The oldest directory commit message is literally “one-shot”; the license is Apache-2.0 and MIT[6]

As engineering, this is solid: using the original’s output as the test oracle is the differential test from Figure 1 scaled to hundreds of files. The problem is the wall. Legal scholar Andres Guadamuz says a clean room is mostly about evidence, showing that the people writing code never had the original in front of them. ArtCraft’s contributor rules describe no separation between observers and coders; the same developer observes Adobe’s software, writes specs and prompts the model, which is exactly where he locates the problem. And what the model read during training cannot be checked from outside.[8]

On progress, the project keeps its own books: as of October 10 it puts itself at about 45% of what a professional would need to replace Photoshop, with 579 open issues and an estimated 1,100 to 1,800 agent-hours before a beta. In under two weeks, all 631 menu entries found in Photoshop were wired up.[8] Those numbers make a concrete point. Reproducing a program’s surface now costs almost nothing, but the half that professionals actually pay for (file exchange without surprises, the plug-in ecosystem, generative features and support) is nowhere near reproduced. (Launch posts: r/Adobe[10], HN 140/86[7].)

chardet 7: source, logs and a dispute

chardet is the Python library for detecting text encodings, with more than 130 million monthly downloads. Mark Pilgrim hand-ported it from Mozilla’s C++ implementation in 2006 under the LGPL inherited from Mozilla’s code; Dan Blanchard has maintained it since 2012.[12] The LGPL kept it out of the Python standard library, and in 2021 Blanchard said publicly that he would relicense it if he could.[13]

In late February 2026 he rewrote it from scratch with Claude Code in five days. It came out roughly 41 times faster and more accurate, shrank from about 100 Python files to about 22, and shipped under MIT.[12] Pilgrim then opened issue #327. His argument fits in one line: they had ample exposure to the original code, so this is not a clean room, and “adding a fancy code generator into the mix does not somehow grant them any additional rights.”[11]

Screenshot of chardet issue #327 "No right to relicense this project"

Screenshot: chardet issue #327. Mark Pilgrim’s post has 1464 thumbs-up; below it is Dan Blanchard’s pinned reply[11]

Blanchard’s response has two parts. First, an admission: after a decade of maintenance, the separation a traditional clean room requires did not exist here. But a clean room is a means, not the end; the end is ensuring the result is not a derivative work, and he could show that by direct measurement.[14] Second, evidence: he later published all the session transcripts with a long write-up.[12]

A few details from that write-up are worth keeping:

  • The model already knew chardet. With no source and no web access, Claude could describe chardet’s two-table state machines, per-encoding byte classes and the use of frequency distributions to break ties between structurally valid encodings. Not perfectly: it got the class hierarchy wrong, omitted several probers and invented names for intermediate states that are bare integers in the source.[12]
  • Old source entered the model’s context in three sessions. On day one a subagent tried to glob the old repository and was denied. Twice he directed the model to files he had written himself. The biggest exposure came when a subagent, working on API compatibility, read the full 567-line universaldetector.py from 6.0.0 via GitHub on its own initiative, two days after the detection engine had been committed. By git blame, 510 of those lines are Blanchard’s and 32 are Pilgrim’s.[12]
  • Three similarity measures came out near zero. git blame -C -C -C attributes none of 7.0.0’s 3,931 lines to Pilgrim. JPlag between 6.0.0 and 7.0.0 gives 0.04% average and 1.30% max, with three matches totaling 47 tokens, all import statements and argparse boilerplate; for comparison, 5.2.0 vs. 6.0.0 peaks at 80%. Copydetect’s maximum of 59% falls on a three-line __main__.py.[12]
  • The architecture really did change. The old version runs dozens of stateful probers in parallel; 7.0.0 is a 12-stage pipeline of stateless functions, and scoring moved from four ordinal buckets to IDF-weighted cosine similarity.[12]

On that basis he invokes the Abstraction-Filtration-Comparison (AFC) test from Computer Associates v. Altai: filter out ideas, standard idioms and elements dictated by the problem, then ask whether protected structure survives.[12] Richard Fontana, a co-author of GPLv3 and LGPLv3, said he sees no basis for requiring 7.0.0 to be LGPL, because nobody has identified copyrightable expression from earlier versions persisting in it.[14]

The other side carries weight too. LWN’s Jonathan Corbet points out that asking an LLM to rewrite in a different style will naturally defeat similarity checkers without breaking the derivative link: had an LLM translated chardet into Lisp, similarity would be low, yet most would agree the result is derived.[13] FSF executive director Zoë Kooyman put it bluntly: “There is nothing ‘clean’ about a Large Language Model which has ingested the code it is being asked to reimplement.”[15] Simon Willison lists what makes the case hard: Blanchard’s decade of immersion; Claude Code consulting old repository files during the work; the model very likely having trained on every prior version; Pilgrim’s own code being a manual port of Mozilla’s MPL code; and the open question of how much reusing the same PyPI name matters.[14] He leans toward the rewrite being legitimate while granting that both sides are credible.

How the AI version differs from a classic clean room

The classic method makes the comparison clear. In 1984 Phoenix Technologies wanted to sell an IBM-compatible BIOS. One group of engineers read the code printed in IBM’s technical manual and wrote a functional specification; a different engineer who had never seen that code wrote the program from the spec alone; every exchange was logged.[8] Compaq’s 1982 IBM PC BIOS clone followed the same structure.[14]

Classic clean room vs. the AI version: where is the wall?Classic (Phoenix BIOS, 1984)Originalcode in IBM manualTeam A: reads itwrites a spec onlywall + logged exchangesTeam B: never saw itcodes from spec onlyAI version (chardet 7 / PhotoCraft)Originalsource / binary / behaviourOne personobserves, specs, reviewswall = prompt + permissionsModel / subagentswrites the codetraining data may contain itunverifiable from outsidechardet 7 logs: subagents read old source in 3 sessions [12]

Figure 2: A classic clean room builds its evidence from the wall between two teams. In the AI version the “wall” is a prompt plus tool permissions, and the model’s training data bypasses it entirely[8][12]

There are three differences.

First, the roles merge. Classically, whoever knows the original may only write the spec. In the AI version one person observes, specifies, reviews and iterates. Ars highlights this: Blanchard says he was deeply involved in designing and reviewing every part, and someone intimately familiar with the old code steering the new code that closely may itself affect whether the result counts as independent.[15]

Second, the wall goes soft. chardet’s setup was an empty repository, only git commands pre-approved, and explicit instructions not to use LGPL code. Those are prompts and permission settings, and a subagent still went and read old files.[12] The lesson is concrete: if you want clean-room discipline with agents, enforce isolation at the filesystem and network level, not in the prompt.

Third, one channel cannot be isolated at all: training data. “Team B never saw the original” is a fact a witness can attest to; whether a model saw it, and how much it retained, cannot be verified from outside.[8] chardet shows a model can remember architecture without remembering details accurately[12]. Whether that helps or hurts on derivation is something no court has ruled on.

Blanchard and antirez argue that a clean room was never a legal requirement, just “an optimization in case of litigation”; the US test is access plus substantial similarity, and if similarity cannot be shown, the process does not matter.[12] That is defensible as law, but be clear about the engineering cost: once you give up process evidence, you rely entirely on outcome evidence, and the outcome metric, similarity, is the one LWN shows is easiest to defeat with a style change.

Discussions of AI rewrites tend to collapse into “does the code look alike?” PhotoCraft shows that is only the top layer.

Risk layers left after low similarityCopyright: literal expressionsimilarity tools, git blame, AFC filtrationmeasurableCopyright: derivationa translation also scores low [13]hard to measureTraining exposurewhether the model saw it cannot be checked [8]unverifiableContract / terms of useAdobe terms bar monitoring I/O to recreate [8]code-independentTrademark / trade dress / patentsfamiliar look, product names, patents [8][9]code-independentchardet 7's three similarity measures cover only the first layer [12]

Figure 3: Similarity tools reach only the top layer; further down, the risk has less and less to do with the code itself[8][9][12][13]

On copyright, case law is fairly friendly to functional reimplementation. In SAS Institute v. World Programming (2012), the EU Court of Justice held that a program’s functionality, programming language and data file format are not protected, that a licensee may observe, study and test software to understand its principles, and that contract clauses forbidding this are void; the same ruling warns that copying the manual can infringe. In the US, the Ninth Circuit held in Sega v. Accolade (1992) and Sony v. Connectix (2000) that copying or disassembling during reverse engineering to reach unprotected elements is fair use. In Google v. Oracle (2021) the Supreme Court found fair use for roughly 11,500 lines of Java API declarations, having assumed without deciding that the code was protected.[8] None of these cases involved AI-assisted reimplementation.[12]

On contract, Adobe’s terms of use, in force since October 2025, forbid recreating its products and specifically name monitoring or tracking an application’s inputs and outputs “in order to recreate that system.” Scripting the real Photoshop to generate test files is that kind of activity; whether the clause holds in Europe is limited by the SAS ruling.[8] The same applies to whatever you point REA at.

On trademark, trade dress and patents, IP Defense’s case study lists these as the residual rights a vendor can actually assert after an AI recreation.[9] PhotoCraft’s README says “Familiar by design” and “If you know Photoshop, you already know PhotoCraft,” and its theme mirrors Photoshop’s, which Ars flags as a trade-dress risk; Adobe holds thousands of patents; and the product names are suggestive enough to interest a trademark lawyer. Guadamuz says, very tentatively, that ArtCraft “may be” on the right side of US copyright law, and places the weak points outside copyright.[8] As of October 13 there was no public action from Adobe and no takedown notice against the project in GitHub’s public registry.[8]

A further layer is whether AI-generated code is copyrightable at all. Courts have held that AI cannot be a patent inventor or a copyright holder on art, but there is no software ruling yet.[15] Blanchard later moved from MIT to 0BSD, a public-domain-equivalent license, precisely to sidestep that question.[12]

What Malus is mocking

Malus draws the whole process as a factory line: upload package.json; robot Team A reads only READMEs, API docs and type definitions; robot Team B implements from scratch on the far side of an “analysis firewall”; delivery comes under the “MalusCorp-0” license, with no attribution, no sharing of modifications and no source disclosure. A fake testimonial boasts of liberating 847 AGPL dependencies in three weeks.[16]

The target is precise. Every formal element of a classic clean room (two isolated teams, public documentation only, audit logs) can be imitated automatically, and imitated form is not substantive independence. A line like “detailed audit logs that definitely exist and are available upon request to courts in select jurisdictions” is aimed squarely at how much weight “I have logs and similarity scores” carries with outsiders.[16] Blanchard concedes the cost drop is a real blow to copyleft as an enforcement mechanism.[12] LWN goes further: if instructing an LLM to rewrite code is enough to strip copyleft, then any software licensing scheme could be threatened.[13]

How to judge it and how to use it

The checklist below is organized by what you intend to do.

You just want to understand a program

Using REA-style tools to understand behavior, debug compatibility or do security analysis carries risk mainly in the license terms. Check the target’s EULA for reverse-engineering clauses. In the EU, analysis for interoperability is protected by law and cannot be fully contracted away; in the US it rests on case-by-case fair use.[8] Keep findings in internal notes and do not paste decompiled snippets into your own repository.

You want to build a compatible replacement

  1. Specs describe behavior and facts only. “After +, % takes a percentage of the first number” is behavior; variable names, function decomposition and table layout are expression. The shared parts of chardet that hold up are facts dictated by encoding standards, such as character substitution pairs and encoding equivalence tables.[12]
  2. Use the original’s output as the oracle, never its code. PhotoCraft’s pixel-level oracle from the real Photoshop is the right engineering approach; just check whether generating those oracle files is itself restricted by the terms of use.[8]
  3. Enforce isolation in the environment. Run the coding agent where it cannot see the original repository or reach the original project’s GitHub, rather than telling it “don’t look.” chardet’s wandering subagent is the counterexample.[12]
  4. Separate observers from coders where you can. If you cannot afford two teams, at least make sure the person who writes the spec and reviews the code is not the same person steeped in the original, and keep the spec under version control.
  5. Keep every log. Session transcripts, tool calls and files read are the only process evidence you will have. Blanchard publishing everything is worth copying, even though it also exposed the gaps.[12]

You want to change the license

This is the riskiest step. Decision points:

  • Use a new name. LWN is explicit: a new module called, say, “detectchar” implementing the same API would have raised far fewer eyebrows.[13] Blanchard kept the name so 130 million monthly downloads would get the speedup automatically[12]; that benefit is real, and so is the cost.
  • Weigh the original author’s position. If they object, the community cost counts even if the law is on your side.
  • Consider 0BSD or public domain. If you do not care how downstream users use it, waiving rights is cleaner than claiming a copyright that may not exist.[12]
  • Do not expect a similarity report to settle it. It shows you did not copy literal code; it cannot show you did not translate.[13]

You are the one being cloned

If your product is closed source, PhotoCraft shows that what you can defend is mainly terms, trademarks, trade dress and patents, plus the half a clone cannot catch up on quickly: edge-case file compatibility, the plug-in ecosystem and service.[8][9] If you maintain a copyleft project, there is currently no technical way to stop an agent rewrite. What you can do is license your test suite and spec documents clearly, since those are what a rewrite most directly reuses.

Closing

The cost of reverse engineering and rewriting has collapsed, while our methods for judging independence still assume two teams and a wall. REA made understanding programs cheap; PhotoCraft and chardet made rewriting from a spec cheap; Malus reminds us that the outward form of a clean room can be faked cheaply too.

My own read is that courts will not give a clear answer soon. Simon Willison expects well-funded litigation once commercial companies see their core IP under threat[14], and that is the likeliest source of the first real precedent. Until then, the only thing practitioners control is process: isolation enforced in the environment, specs limited to behavior, complete logs, and a new name when the license changes. None of that guarantees you win in court, but it means that when someone challenges you, you have more to show than a similarity report.

References

  1. morluto, rea (GitHub repository; 161,865 stars, +45,327 on Oct 13) ↩
  2. REA, REA — Reverse Engineering for Your Coding Agent (site with Calculator and dinosaur-game examples) ↩
  3. Hacker News, REA Reverse – Engineer Anything (2026-10-10, 800 points / 337 comments) ↩
  4. YouTube, I Tested The Viral Github Repo To Reverse Engineer Anything ↩
  5. YouTube, The Fastest-Rising Repo on GitHub Is a Little Scary ↩
  6. storytold, photocraft (GitHub repository) ↩
  7. Hacker News, Adobe Creative Suite Cleanroom Port to Rust (2026-10-06, 140 points / 86 comments) ↩
  8. Alexandre Noto, A developer cloned Photoshop with Claude. Is that legal? (Declic Media, 2026-10-13) ↩
  9. IP Defense, AI Recreated Adobe-Like Software. What Could Adobe Actually Protect? (law-firm case study, PDF) ↩
  10. Reddit r/Adobe, PhotoCraft: I’ve created an open source 100% Rust clean-room clone of 7 of Adobe’s apps ↩
  11. chardet, Issue #327: No right to relicense this project (2026-03-05) ↩
  12. Dan Blanchard, Everything Claude Saw: A Transparent Account of the Chardet v7 Rewrite (2026-03-29) ↩
  13. Jonathan Corbet, The relicensing of chardet (LWN, 2026-03-05) ↩
  14. Simon Willison, Can coding agents relicense open source through a “clean room” implementation of code? (2026-03-05, updated 03-27) ↩
  15. Kyle Orland, AI can rewrite open source code—but can it rewrite the license, too? (Ars Technica, 2026-03-10) ↩
  16. Malus, Clean Room as a Service (satire site; HN 1433 points / 531 comments, Mar 2026) ↩