A new wave of AI-driven reverse-engineering is exploding across consumer devices and software, with people using agents to decompile, clone, and replace proprietary firmware and apps. Enthusiasts have used AI to swap TV operating systems, convert smart picture frames into AI calendars, strip ads from baby monitors, and resurrect bricked Lululemon mirrors. A GitHub project called Reverse Engineer Anything surged to roughly 342,000 stars by providing agents that inspect closed apps, explain features, and generate working replicas; one viral social post claiming Claude Code removed 25 Xiaomi packages from a TV drew millions of views. Similar tactics have produced rapid AI clones of Creative Cloud, Office suites, video games, and even guitar-pedal algorithms, enabling near-instant copying of competitor features.
That agentification, plus fewer model guardrails, has collapsed barriers to copying but produced a flood of low-quality, buggy, insecure “AI slop.” Many clones won’t be maintained properly, will introduce vulnerabilities and malware vectors, and will overwhelm reverse-engineering and open-source communities. The trend is reshaping business incentives - threatening SaaS and smaller vendors through easy theft and undercutting - while also empowering repair and reclamation of functionality manufacturers removed. Expect hastily produced software on critical hardware, novel security risks, and a messy mix of beneficial repairs and destructive cloning.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.