Reverse Engineer Anything.
It seemed to happen overnight. One morning it wasn’t there, and the next, it was.
I’m talking, of course, about Minecraft appearing inside Grand Theft Auto V.
You don’t need to be a gaming expert to know this is not supposed to happen. Minecraft and Grand Theft Auto are two completely different titles, made in different engines, with different items, enemies, etc. Virtually nothing about the two are the same. And yet, here they were, one inside the other.
It’s a fun trick. It could also be disastrous.
The mashup was built in about two days by a developer working with an AI coding agent. Both games run at the same time, and a mod on each side passes events back and forth: set off TNT in Minecraft, and an explosion goes off in the same spot in GTA. It’s clever, and it’s harmless. But it arrived alongside something much bigger: a GitHub project called REA, short for Reverse Engineer Anything, which racked up hundreds of thousands of stars in a matter of days in October.
The difficulty of reverse engineering has quietly been one of software’s best defenses. It’s always been possible. It’s just never been easy. Picking apart compiled software means wading through messy, half-guessed code, and making sense of it has always taken skilled specialists a lot of time. Like, a lot of time. REA changes that. It hands the work to an AI agent, which runs the specialists’ tools itself: reading the mess, working out what the program does, and rebuilding it, sometimes in under an hour. Reverse engineering has always been possible. What’s changed is that it’s becoming fast and cheap.
You can already see the results. Skate 3, an Xbox 360 and Playstation 3 game, is now playable in a web browser, running on a fan-built engine, suddenly live after years of reverse-engineering research. A developer used an AI model to build open-source alternatives to seven Adobe apps, including Photoshop and Premiere, in about two weeks. They’re still in alpha and far from matching Adobe, and the developer says they were built by studying how Adobe’s apps behave, not by copying their code. But two weeks for that much software would have been unthinkable a year ago.
So who cares? Playing one video game inside another is a cool technical feat, but it doesn’t matter much. Right?
The problem is that the same tool doesn’t care what it’s pointed at. For years, software companies have leaned on an unspoken assumption: code shipped to your computer is safe because it’s too expensive to read. As one security firm put it, whatever ships inside an app “was never secret, only expensive to read.” REA makes it cheap.
That matters because apps routinely carry things they shouldn’t. Researchers have found working cloud credentials hard-coded into thousands of mobile apps. Apps reveal the hidden addresses of the servers they talk to. Some run their security checks on your device rather than on the company’s servers, so anyone who can read the code can see how to get around them.
Think about your banking app. A hacker can’t download a bank’s servers, but they can download the app that talks to them. With AI-assisted reverse engineering, mapping out how that app talks to the bank, what it checks and what it trusts goes from weeks of expert work to something far faster. Mapping the system is often half the battle in hacking. That’s why phishing is so common: why break a system when you can steal the key? Tools like REA make breaking the system a lot more attractive.
Then there are security updates. When a company patches a flaw, attackers can compare the old and new versions to find exactly what was fixed, and then target everyone who hasn’t updated yet. Even before AI, attacks typically started within days of a flaw being disclosed. If AI shortens that analysis to hours, the window to protect yourself shrinks with it.
REA’s creators say it’s meant for security research, malware analysis and making software work together, and defenders can use it too. There are no reported cases of it being used in an attack, yet. But that’s part of the problem: we don’t know what we don’t know. This tool went mainstream in a matter of weeks. What does this look like in six months? A year?
Right now, the United States doesn’t have a comprehensive federal AI law. Instead, the federal government has spent the past year trying to stop states from regulating AI on their own. A December 2025 executive order directed the Justice Department to challenge state AI laws, and a bipartisan House proposal to pause state AI rules for three years has stalled since June. In September, the Speaker of the House said Congress shouldn’t “panic” into “emergency” AI regulation. The result is a country trying to preempt state rules without a federal framework to replace them.
I won’t pretend to be a regulation expert, and there isn’t a clean answer here. Regulation can’t un-publish an open-source tool, and it shouldn’t ban reverse engineering, which security researchers depend on. All I know is, right now, we’re mostly relying on the hope that the people using these tools mean well. And while some may call an open-source Photoshop vigilante justice, it’s still very illegal. Even though we are seeing the tool used in ways that have a mainly net positive impact, there’s no doubt that its use is being applied to nefarious and illegal activity. We have an option to at least try and stop it from going too far.
It’s a little absurd to say, but Minecraft in GTA might be the first sign of a much bigger problem. It doesn’t have to be the beginning of the downfall of the internet, but that depends on lawmakers taking it seriously before the damage shows up.
Comments