PJFP.com

Pursuit of Joy, Fulfillment, and Purpose

,

Claude Code Blocked REA? The Real Story Behind Craft Anything

In late October 2026, X decided that Anthropic had quietly killed Reverse Engineer Anything (REA), the open-source tool that lets AI coding agents take apart apps, firmware and websites, and on November 3 a widely shared post presented Craft Anything, a new open-source tool from the team behind the free Adobe clones, as the answer. Both halves of that story are partly true. This piece walks through what users actually hit, what Anthropic has and has not changed, how REA and Craft Anything work under the hood, and what it all says about agentic coding at the end of 2026. Everything here is current as of November 3, 2026, and this is a fast-moving story.

TLDR

Claude Code users really are seeing reverse-engineering sessions die mid-answer, but the cause is Anthropic’s deliberately broad cyber classifiers, which predate the viral posts and are documented in the Opus 5.5 system card, not a ban aimed at REA. The one targeted change Anthropic has acknowledged is a two-sentence Claude Code instruction against recreating specific existing games. REA is alive and growing fast at more than 425,000 GitHub stars. Craft Anything, a pure-Rust “study it, then rebuild it” engine from the ArtCraft team, was billed on X as the answer to the block, yet its default builder is Claude Code itself.

Thoughts

The “Anthropic killed REA” story is wrong in its specifics and right in its effect. No announcement, changelog or policy names REA, and the Opus 5.5 system card spells out the actual rule: Anthropic “allows vulnerability discovery in source code” but “blocks vulnerability discovery in compiled binaries” because “it is more commonly an offensive technique.” Much of REA’s work happens inside compiled binaries, and binary analysis looks a lot like the vulnerability hunting the classifier was built to stop. So when a developer points Claude Code at their own TV firmware or an old game executable, the classifier sees exactly the shape of work it was built to stop, and the session ends. Whether you call that a ban or a side effect matters a lot to Anthropic’s lawyers and very little to the person staring at a dead session. The honest framing is that the most popular reverse-engineering tool on GitHub runs straight into a filter that Anthropic openly describes as “intentionally broad,” and Anthropic has chosen to accept those false positives as the price of shipping stronger models faster.

The rumor got the target wrong but caught a real policy shift. On October 30, Anthropic’s Addy Osmani confirmed that the company “added two sentences to Claude Code’s prompt on Opus 5.5 to steer it away from recreating someone else’s specific game.” That is a targeted change, aimed at recreation rather than inspection, and it lands on exactly the workflow Craft Anything sells. We checked: a Claude Code session running on November 3 carries the instruction “Don’t build a recreation of a specific existing game (its name, characters, art, music, levels or look), even if it is renamed or called original.” The cyber classifier and this prompt rule are different mechanisms, a filter that interrupts versus an instruction the model follows, and most coverage blurred them together. Keeping them apart explains why some users say inspection still works while cloning does not.

Craft Anything is less a rebellion against Claude than a wrapper around it. The @rammcodes post that launched it into the conversation said “Claude is blocking REA,” but the Craft Anything repository never mentions REA, morluto or any block. Its default builder is the user’s own unmodified Claude Code, run headless on Opus 5.5, and its docs carry a section titled “Why this is within Anthropic’s terms.” What it actually adds is an inspection engine that does not need the model to do the dangerous-looking part. Disassembly, page capture and screenshot comparison run in Rust on your machine, and the model mostly sees evidence and writes new code. That is a smarter answer to classifier friction than prompt tricks, and it is also an answer REA’s own disclaimer would approve of, since REA refuses to help with “evading the usage policies or safety measures of AI model providers.”

Switching models is not the escape hatch people think it is. A REA user asking how to get around the filters in discussion #2095 reports being blocked on Claude Code, Codex and Cursor alike. The researcher behind the most viral Samsung TV teardown, @log4j, says he used ChatGPT and that OpenAI blocked him under a “Cyber Abuse” label. OpenAI’s public position is more relaxed than Anthropic’s: an OpenAI researcher replied on X that the blocks were “mostly accidental,” that “there is no prohibition against reverse engineering with codex,” and that it was “getting fixed.” But a policy that says yes and a classifier that says no produce the same dead session, and every frontier lab is fighting the same blurry boundary between inspecting software and attacking it. The durable pattern is the one Craft Anything and REA both follow: put the inspection in local tools you control, keep an evidence trail, and treat the hosted model as one replaceable part.

Key Takeaways

  • Anthropic has made no announcement, changelog entry or policy change naming REA. The blocks come from cyber safety classifiers on Opus 5.5 and Sonnet 5.5 that Anthropic calls “intentionally broad.”
  • The Opus 5.5 system card says the policy blocks “vulnerability discovery in compiled binaries,” which overlaps heavily with REA’s native-binary work.
  • Flagged Opus 5.5 requests in Claude Code fall back to Opus 4.8, and the check reads the whole conversation, so one flag tends to poison the rest of a session.
  • Anthropic did confirm one targeted change: a two-sentence Claude Code instruction, added on October 27 according to Mavday, against recreating a specific existing game.
  • The viral posts came after the friction, not before it. Reports of cyber flags in Claude Code go back to at least July 2026, and Mavday’s count of GitHub issues shows no spike around October 23.
  • OpenAI and Cursor have also blocked or banned reverse-engineering work, so switching agents is not a reliable fix.
  • REA had 425,661 stars, 106,009 forks and 355 contributors on November 3, and its latest release is rea-agents v6.8.0 from October 25.
  • REA’s official homes are github.com/morluto/rea, rea.tools and the rea-agents npm package. A fake REA repo spread a Windows trojan in mid-October.
  • Craft Anything launched on October 31, shipped three releases in about 50 hours, and exposes more than 300 tools (314 per its README) as both CLI commands and MCP tools.
  • Craft Anything’s default builder is Claude Code itself, and the “built because Claude blocked REA” story comes from an X post, not from the project.
  • The ArtCraft suite now lists 16 free, pure-Rust apps, and PhotoCraft alone has more than 76,000 stars. Claude Opus 5.5 is a co-author on 56 of PhotoCraft’s last 100 commits.
  • In one developer survey published November 2, Claude Code was the primary coding tool for 30.1% of respondents, ahead of GitHub Copilot at 22.2%, Cursor at 12.8% and Codex at 12.1%.

Detailed Summary

How the “Claude killed REA” story spread

The thread that started it, “Anthropic secretly killed the REA train,” appeared on r/claude on October 21. It showed Claude Code sessions stopping with messages like “I can’t finish this document. The earlier session’s attempt to write it was stopped by a safety classifier, and I was told not to produce that content again, even reworded.” On October 23, @AbhinavXJ posted that “anthropic just killed the REA,” and hours later @0x0SojalSec said Anthropic had “quietly killed REA,” tying the timing to viral Samsung TV firmware teardowns. Together they drew well over a million views. Outlets including Kotaku, XDA and Tom’s Hardware picked it up within days.

Fact-checks pushed back hard. Mavday found “no announcement, Claude Code changelog entry or usage policy change that names REA or reverse-engineering tools.” Capital and Compute put it more bluntly: “What changed in October is volume and visibility, not the existence of the gate.” The Samsung link also wobbles. The researcher behind the most viral teardown says he used ChatGPT, and it was OpenAI that blocked him, although XDA separately reported a Samsung Tizen breach done with Claude Code. Not every user agreed there was a block at all. Fabio Makita (@AkitaOnRails) reported on October 21 that Claude Code, Codex and OpenCode ran REA normally, and only one agent failed because it could not load REA’s 207 tools.

What Anthropic actually runs

Anthropic launched Opus 5.5 on September 22 and Sonnet 5.5 on September 28 with real-time cyber safeguards. The Opus 5.5 announcement says “most cybersecurity tasks will be re-routed to Opus 4.8,” and the system card describes “a temporarily wider safety margin against jailbreaks.” When the classifier fires, Claude Code’s own error text says: “Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work.” The model configuration docs add that a repository containing security material “can trip the classifier on that context alone.”

On October 6, Anthropic expanded its Cyber Verification Program, conceding that its generally available models block most cyber work. Individual researchers with a track record of reported vulnerabilities can apply for Defense Access on a paid plan, which explicitly covers “reverse-engineering malware.” Red Team Access is for organizations only. The updated usage policy, effective November 12, 2026, says it “does not prohibit security research, testing, or tool development conducted on systems you own or operate,” and adds that “encountering a block does not by itself indicate a violation.” Both lines are new in that update, though Anthropic’s announcement of it did not mention them.

The one targeted change: games

The deliberate change Anthropic did make is about cloning, not reverse engineering. X user Chasm posted what appeared to be a new Claude Code instruction against recreating specific existing games, and on October 30 Addy Osmani of Anthropic confirmed the two added sentences, citing the usage policy’s ban on IP infringement. Game Developer reported that an Anthropic spokesperson pointed to his post. It came after an October wave of AI-made game decompilations, AI clones at Steam Next Fest and small developers threatened with copies of their demos. In Mavday’s tests, Claude Code refused to clone Tetris but built a Flappy Bird lookalike. Separately, Jarred Walton told Tom’s Hardware that reverse-engineering checks on his own software worked until October 31, and switching to Opus 4.8 let him continue.

What REA is and how it works

REA was created by the pseudonymous developer morluto, starting on April 14, 2026 as a 39-tool wrapper around Hopper’s MCP server. It is now a Node package, rea-agents, with two front ends: a local MCP server that agents like Claude Code, Codex and Cursor call, and a rea command line that runs the same workflows from a terminal. Setup is npx rea-agents setup, which registers the server with up to 24 supported agents and installs investigation instructions. REA does not replace professional tools. It orchestrates them. Deep native work goes to Hopper, Ghidra, IDA or the Kuna decompiler, Android goes to JADX or JEB, and it also drives Frida, GDB, Rizin, Binwalk, TShark, adb and Chrome. Many formats, including .NET, JavaScript bundles, Go and Rust build data and Unity’s IL2CPP, are parsed by REA’s own code.

Every result comes back with evidence: pseudocode, strings, call graphs, network captures or screenshots, plus notes on coverage, limits and unknowns. Content pulled from a target is marked untrusted, so the agent treats it as data rather than instructions. The README frames the goal simply: “See a feature you like. Understand how it works, down to the binary level.” The project’s growth has been absurd. It went from under 10,000 stars on October 6, according to OSSInsight data cited by Startup Fortune, to more than 400,000 by October 30, with eight minor releases in 16 days. Its disclaimer limits it to “lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.”

What people actually use REA for

The documented uses are mostly mundane and often useful. The official showcases include a DX-Ball rebuild that passes 3,205 test cases, a look inside Notion’s Electron app and an old Touhou game demo. Community builds include a Civilization V crash patch on the Mac, a game port to Android, control of a Mitsubishi air conditioner after REA showed its app routes through a cloud service, and new software that drives cheap USB status screens at 20 to 30 frames per second instead of about one. One developer wrote that REA “drew a clearer picture of my architecture than the one in my own memory” after pointing it at their own installer. Smart TV ad and telemetry removal is the use that went viral, and it is the one most likely to trip filters.

The legal stakes are real. Cornell Tech law professor James Grimmelmann told Scientific American that “this is going to pose a crisis for trade secret and copyright law,” because copyright protects code but not the ideas it implements. Security firm Qubitron Labs argues that minified JavaScript and compiled binaries now “barely slow an agent,” so anything valuable that ships to the client should be treated as published. REA’s own disclaimer refuses help with circumventing DRM, license checks or anti-cheat. Morluto says he isn’t worried, and calls the blocks a “fiasco” that just brings more attention to the project.

How Craft Anything works

Craft Anything is a pure-Rust project with 13 internal libraries and three front ends: an egui desktop app, a command line and a WebAssembly viewer. It describes itself as a way to “see how any website, app or game works, then have AI build your own version.” Each of its more than 300 tools (314 per the README, 317 by our count of the code) is both a CLI command and an MCP tool, so any agent can drive the same engine the app uses, and none of the inspection needs AI. Unlike REA, it ships its own disassembler and decompiler and needs no outside program. Ghidra, JADX, Frida, Rizin, a Chromium browser and others are optional extras.

The pipeline runs in four steps:

  1. Study. For a website, it captures the page at three widths (1440, 768 and 390 pixels) plus up to four other pages. For a program or game, it triages the file and records what it finds.
  2. Build. A coding agent writes a new project, and it is only allowed to change files inside the project’s app/ folder.
  3. Check. For websites, it compares screenshots of the original and the rebuild at each width against a 90% likeness bar. For apps and games it mainly checks that the build succeeds, and the README marks behavior checks as “partly there.”
  4. Refine. Differences go back to the agent for up to six rounds in the app and two in the CLI.

The agent is usually Claude Code. Craft Anything starts the user’s own claude program in headless mode with Opus 5.5 as the default model, makes its own MCP server the only tool server, and routes every permission request through its own approval tool. That tool allows edits in app/ and a fixed list of build commands. Auto mode is on by default, so it rarely stops to ask, and only deletions outside the project, system changes and publishing are refused. Billing stays on the user’s Anthropic account: the README says it “runs your own, unmodified claude program, which uses your own sign-in.” Adapters for Codex and other agents exist, but only Claude Code is verified as a builder.

Every tool returns an evidence record with a confidence level (Observed, Derived or Inferred), its source, what it covered and its limits, and the record’s ID is a hash of its contents so later edits show. The default “clean room” mode means “nothing inside the original is read, not its code, files or page source,” and that part is enforced in code: only an allow-list of 104 tools can run, and the approval tool refuses to read the original’s folder or fetch from the target’s site, though the docs say these limits apply to Claude Code rather than other agents, and the clean-room chat behavior has not yet been checked live. The rules against copying logos, photos and text, and the README’s promise that it “never bypasses DRM, logins or anti-cheat,” are prompt instructions rather than code. In the optional Deep mode, game rebuilds can copy a game’s unencrypted art, sounds and models into an app/Original/ folder, with a required note that the build is for private use only, and the extractor’s prompt tells the model that the person owns the game and has its developer’s permission.

The ArtCraft team behind it

Craft Anything comes from ArtCraft, the storytold GitHub organization led by Brandon Thomas, whose GitHub bio reads “Founder: ArtCraft, Storyteller.ai, FakeYou.” Some outlets also describe him as a former Square engineer, which we could not confirm from primary sources. The first ArtCraft apps went up on September 30 and went viral around October 7 as free, open-source, pure-Rust stand-ins for Photoshop, Premiere, Lightroom, Illustrator, After Effects, InDesign and Acrobat. The suite now lists 16 apps, adding stand-ins for Figma, Word, Excel, PowerPoint, AutoCAD and Pro Tools. They are dual licensed MIT or Apache-2.0.

Claude Opus 5.5 did much of the writing. It is listed as co-author on 56 of PhotoCraft’s last 100 commits, and the roadmap measures remaining work in “Opus 5.5 agent-hours.” The apps are early: PhotoCraft’s README says it “is not yet a Photoshop replacement for daily professional work,” and XDA’s testing found Photoshop does not reliably open PSDs that PhotoCraft saves. The detail that matters most for this story is that every ArtCraft app already ships a command line, a JSON control channel and an MCP server, with more than 500 commands in PhotoCraft alone. The team was building software for agents to drive before Craft Anything existed. Whether ArtCraft’s AI-written code really earns the “clean room” label is disputed by critics, and Adobe has not publicly responded.

The agentic coding market around all this

The friction matters because so much development now runs through these agents. A First Page Sage survey of 2,514 developers in North America and Europe, published November 2, found 30.1% name Claude Code as their primary coding tool, up from 18.5% in January. GitHub Copilot followed at 22.2% (and still leads at companies with more than 5,000 staff), with Cursor at 12.8% and Codex at 12.1%. The publisher is an SEO agency and the weighting is not fully explained, so treat the numbers as directional. The same survey found terminal agents as the primary interface rose from 21.3% to 38.8% this year. Nearly every major agent supports MCP, which is why one tool like REA could reach 24 of them at once.

Notable Quotes

“We block vulnerability discovery in compiled binaries because it is more commonly an offensive technique.” (Anthropic, Claude Opus 5.5 system card, explaining why its safety filters flag this kind of request)

“Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work.” (Claude Code’s error message when the cyber classifier fires)

“We added two sentences to Claude Code’s prompt on Opus 5.5 to steer it away from recreating someone else’s specific game because using Claude to infringe IP is against our usage policy.” (Addy Osmani of Anthropic, on X, October 30, 2026)

“I’ve tried Claude Code, Codex, and Cursor, but execution is frequently blocked due to ‘sensitive reverse engineering’ triggers.” (A REA user in GitHub discussion #2095)

“This is going to pose a crisis for trade secret and copyright law.” (James Grimmelmann, Cornell Tech, to Scientific American)

“Clean room (the default): nothing inside the original is read, not its code, files or page source.” (Craft Anything README)

“What changed in October is volume and visibility, not the existence of the gate.” (Capital and Compute)

The people who started this story were right that something changed for reverse engineering in Claude Code, and wrong about what. Craft Anything is now part of that story. You can see its launch post here:

Read the REA project itself on GitHub, and Craft Anything here.

Related Reading

Keep reading