REA backlash: client hardening, anti-AI reversing tools and trojan fake repos
A 字母AI article republished by 钛媒体 describes the fallout from REA, an agent that does not decompile itself but orchestrates tools such as Ghidra, IDA and Hopper. French tech blogger Korben tested it with Opus 5.5: the agent wrote a working Python keygen for a crackme binary in about two minutes at roughly $0.5 in API cost, and the keygen passed verification with 479 random usernames. Elias Bachaalany, co-author of Practical Reverse Engineering, called it hype, noting GhidraMCP and IDA Pro MCP already enabled AI-assisted reversing in 2025. The article also reports Thales releasing Sentinel Envelope Plus, which in Thales' own controlled test left an agent finding none of 10 vulnerabilities it found in the unprotected app, with 970x token consumption; and a fake GitHub org, rea-tools, shipping an 82.6 MB trojanized archive that had been downloaded 172 times when reported, after which maintainers merged a README warning on Oct 13 listing only three official channels.
The article argues that orchestration-style agents like REA lower the cost of reverse engineering, pushing teams to move keys and trust decisions server-side, while impersonation repos target users accustomed to granting agents shell and network access.
（本文作者为 字母AI，钛媒体经授权发布）
文 | 字母AI
各个App的产品经理们总是水火不容，“你的UI是垃圾”、“这交互是给人用的？”、“你是伪用户视角，拿少数用户个案代表全量”。
可当REA爆火之后，这群产品经理们一瞬间就完成了战线统一，一致对抗REA。
产品是这群产品经理们的命脉，有了REA，这些产品的护城河几乎荡然无存。
法国技术博主Korben用Opus 5.5对REA进行实测。
#REA#Ghidra#IDA Pro#Hopper#Thales#Sentinel Envelope Plus#Quarkslab#Opus 5.5#Microsoft Defender#VirusTotal