Is AI-Powered Reverse Engineering the Death of Proprietary Software?

When Nishant Tiwari, a software engineer at PayPal and a tech content creator with over 2.8 million followers on Instagram, set out to examine Uber's pricing, he used an AI-assisted reverse-engineering workflow to inspect the company's web application. His analysis of Uber's client-side code identified scripts that appeared to access battery status and other device information, including browser and hardware attributes.

Nishant tested the same ride across four phones—three Android devices and an iPhone. He repeated the experiment five to six times and realised the results showed a correlation between battery levels and fares.

The findings were enabled by tools such as Reverse Engineering Anything (REA), an open-source GitHub project that connects AI agents to reverse-engineering tools that can help developers examine software and infer how it works. REA was created by GitHub user morluto, who declined to participate in the story.

The project has over 447,000 stars on GitHub—up from just 10,000 stars in early October—listing among the top five most-starred repositories on the platform.

For companies selling proprietary software, the question is how much of their product's functionality customers can reconstruct from the code and behaviour available to them.

Reverse Engineering is Becoming Accessible

Reverse engineering involves examining a finished software product to understand how it works. Developers may inspect a compiled binary, use a debugger to observe its execution, or analyse how an application responds to different inputs.

Security researcher and engineer Himanshu Anand explains the process traditionally required considerable technical expertise. Engineers needed to interpret assembly instructions and connect individual functions to understand the larger system. Large language models have lowered that barrier. 

"Reverse engineering was always there. People used to debug code or find bugs with it, but with LLMs, it has lowered the threshold of reverse engineering," Anand tells AIM.

He estimates that a reverse-engineering task that previously took a month could now take "one or two hours" with AI assistance. 

Limitations

AI-assisted analysis can help a developer recreate individual software features, particularly when their behaviour is visible through a client application. However, reconstructing a feature does not necessarily mean reproducing an entire product.

A desktop or mobile application may expose some of its code to the user, while core processing happens on remote servers. Anand points to services such as Gmail, where users cannot see the full code and can only conduct black-box testing, which he describes as "very limited."

Abhishek Agarwal, President of Judge India and Global Delivery at tech consulting firm The Judge Group, says AI can help developers identify relevant functions and reduce time spent following false leads. But "much of a product's behaviour may depend on a private service."

A recreated feature may also lack the original product's updates and support. Companies pay for these services alongside the software itself.

Yet, there have been concerns that the democratisation of AI-powered reverse engineering tools may sound the death knell for software as we know it. According to a report from Tom’s Hardware, Anthropic has quietly started restricting Claude’s capabilities in modding, decompiling, or reverse-engineering video games. 

However, Anand dismisses those concerns as unfounded. "It’s like saying Microsoft is dead because of open source," he quips.

A company investing heavily in a proprietary feature could face pressure if another vendor builds a convincing substitute sooner and customers see little difference. However, Agarwal cautions against treating every imitation as a commercial threat.

"A familiar screen is easy to recognise; dependable integrations, customer-specific data, and support are harder to reproduce," he notes.

Agarwal suggests comparing conventional reverse engineering with AI-assisted analysis under similar conditions. Two engineering teams could be given the same access to a product and asked to reconstruct a feature, with the results assessed for reliability and the human effort required.

"Speed alone is interesting; repeatable commercial substitution is the stronger signal," he remarks.

What Indian Law Protects

Bharadwaj Jaishankar-Bharadwaj, Partner at CMS INDUSLAW, notes copyright protects software code as a literary work. He also discusses protection for software front end's layout, while distinguishing it from the underlying functionality. "The basic tenet of copyright law is that there is no copyright in an idea; it's only in the expression," he says.

However, Shantanu Sahay, Partner, Litigation, at law firm Anand & Anand, believes recreating a feature does not automatically infringe copyright. 

The absence of copied source code is not conclusive if substantial protectable elements of the original are reproduced. The legal question can depend on what has been copied and whether those elements are protected.

Section 52(1)(ac) of the Copyright Act permits the observation, study, or testing of a computer program to determine its underlying ideas and principles while performing acts necessary for the functions for which it was supplied. Section 52(1)(ab) covers acts necessary to obtain information essential for interoperability of an independently created program, subject to conditions including lawful possession and the information not being otherwise readily available.

These provisions do not provide a blanket permission to copy or commercially reproduce software. Sahay notes licence and non-disclosure agreements can also restrict decompilation. The protection for closed-source software also depends on how their license is crafted.

Limiting Exposure

For enterprises, the security question begins with what is distributed to customers. Agarwal says companies should treat client applications and binaries as inspectable, rather than relying only on the fact that source code is unpublished.

Obfuscation and anti-tampering measures can make analysis harder, but they may only delay it. Companies also need to examine what their applications contain, particularly credentials, sensitive rules, and information that could be kept on the server.

Agarwal recommends moving core business logic away from distributed clients where practical, removing secrets from software builds and tightening API boundaries. Monitoring can help detect repeated probing, while release reviews should include inspection of binaries, packages, and front ends.

He also recommends that the design assumption should change from asking whether someone can reverse engineer a product to considering what happens when an AI agent can inspect it repeatedly and cheaply.

For enterprise software companies, the risk is therefore not simply whether AI can inspect their applications. It is whether it can produce a reliable substitute for a feature customers are willing to pay for.