REA is a toolkit that links AI agents to reverse-engineering tools through a single MCP protocol, enabling analysis of applications and native binaries without source code. Agents call REA to inspect targets locally and receive structured findings with evidence and limitations; those findings drive follow-up questions, explanations, and generated implementations. Setup registers REA with agents via npx rea-agents setup and integrates with Hopper, Ghidra, or IDA for native workflows, while static JavaScript/Electron and website inspection run without native engines. A CLI provides direct commands (analyze-javascript-application, rea update) and adapters for multiple agent providers including Claude Code, Codex, Gemini CLI and others.
REA returns concrete artifacts useful for engineering and triage: pseudocode, assembly, symbols, strings, calls and references for native binaries; ELF/PE/Mach‑O layouts and static mitigation candidates; decompiled methods and manifests for Android/APKs; Node/Electron module graphs and IPC boundaries; WASM WAT output and EVM dispatch selectors; recorded crash threads and diagnostics; Go build provenance; firmware extraction handoffs; and HAR/network captures. Requirements include Node.js 22/24/26+ plus host tools (Hopper/Ghidra/IDA, JADX, pwntools, WABT, adb, a Chrome-family browser) where applicable. Analysis runs locally, produces evidence-backed conclusions, supports snapshots and scripting, and is accompanied by documentation, guides, and active maintenance.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Michael Smith was sentenced to 18 months for using AI and thousands of bots to flood music streaming platforms with fake plays, earning him over $8 million in royalties. This case is the first DOJ prosecution involving AI-assisted music streaming fraud. (nytimes.com)
AI models can embed encrypted backdoors that hide arbitrary capabilities, making them provably difficult to elicit even with full access to model weights. This challenges the reliability of capability evaluations and limits the effectiveness of capability audits. (arxiv.org)
Anthropic has significantly improved defenses against distillation attacks, reducing data theft by 90 to 99 percent. These attacks, which clone AI capabilities without authorization, pose risks to safety and national security, prompting stronger protective measures. (anthropic.com)
Raven, an AI tool developed by Graylark Technologies, enables law enforcement to identify specific homes from interior photos by analyzing features and matching them with data from Zillow and Airbnb. The technology can geolocate interior images across millions of rental units worldwide, raising privacy concerns. (404media.co)
GPT-6 Astra helped jailbreak a Kindle to turn it into a photo slideshow device controlled by an AI agent. The project involved creating custom software to cycle through images and bypass restrictions on the device. (nirajrajgor.com)
Ukrainian strikes on Russian data centers did not eliminate Russian disinformation or bots on social media. The narrative linking the strikes to a reduction in disinformation is false, and the attacks were retaliatory actions unrelated to disinformation efforts. (machinesociety.ai)
Today's best Hacker News stories, summarized and screenshotted, one email a day.