Intezer AI Reverse Engineering: REA MCP, Agent Harnesses, and What to Lock Down

Intezer’s November 10, 2026 research and the REA “Reverse Engineer Anything” MCP server show the same shift: AI coding agents are no longer assistants that comment on source—they are harnesses that chain disassemblers, static analysis, and reconstruction loops across proprietary apps and malware. Intezer’s research index lists “When Everything Becomes Open-Source” for that date; Dark Reading’s coverage quotes Intezer researcher Nicole Fishbein on rebuilding Slack, Apple’s Finder, and a Turla-linked sample. In parallel, morluto/rea documents an MCP server and npx rea-agents setup flow that registers reverse-engineering tools directly into Claude Code, Codex, Cursor, and other agents. If you run coding agents on a laptop that also holds API keys, customer source, or incident-response disks, the actionable question is not whether reverse engineering is “good” or “bad”—it is which MCP and shell permissions you just approved.

TL;DR

What Intezer tested (mechanism)

Intezer Research listed “When Everything Becomes Open-Source” on November 10, 2026. The full write-up was not yet retrievable at a stable permalink when we drafted this post; mechanism detail below follows Fishbein’s description in Dark Reading, attributed to Intezer’s lab work.

The research picked three high-friction targets:

1. Slack’s desktop client — largely JavaScript the team could unpack from the shipped app. Fishbein says they reproduced the client “very simply” but could not fully reconstruct server-side infrastructure from what the client exposed.
2. Apple Finder — moderate difficulty: enough behavior for everyday file actions and local search, but not a byte-accurate clone of internal structure.
3. Turla-linked malware — hardest of the three. The team built a deterministic Python control plane around a compiler, VM, static analysis tools (including output from tools such as Binary Ninja), and multiple LLMs.

Harness shape (step by step)

Fishbein’s description matches how serious agent workflows are built today—whether for defense or abuse:

1. Orchestrator agent breaks a large binary into functions using static-analysis boundaries.
2. A reconstruction agent proposes source or pseudocode per chunk.
3. A test agent checks whether the rebuild runs and behaves like the sample.
4. For malware, the harness stays non-execution-first where possible—analysis without firing the payload.

The output for Turla, per the interview, was a working picture of command reception, file transfer, and related pipeline stages—exactly the material defenders want, and exactly the material copycat malware authors want too.

Fishbein’s broader point: each target required a different harness. One program might let you ask Claude to rebuild source; another refuses; malware needs extra models and safety wrappers. That mirrors what agent operators already see with permission modes and refusals: the model is not the harness.

Why Slack was “easy”

Electron-style clients ship readable JS, huge dependency trees, and predictable file layout—similar to how supply-chain attackers hunt secrets in repos agents already scan. Fishbein notes attackers cloning popular apps (“vibe code apps that mimic other very common apps”) as a motivating scenario. Server-side secrets stayed out of reach only because they were not exposed to the customer bundle—a reminder that client-only IP is the low hanging fruit.

REA: the MCP server developers actually install

While Intezer’s work is research-grade, morluto/rea is productized for everyday agents. The README describes REA as:

• MCP + CLI for binaries, Electron/JS, .NET, APKs, firmware, and websites.
• npx rea-agents setup — previews config changes, asks approval, backs up agent files, registers MCP, installs workflow instructions.
• Supported agents include Claude Code, Codex, Cursor, Gemini CLI, Grok Build, OpenCode, and others listed in docs/installation.md.
• Node.js 22.x, 24.x, or 26.12.1+ and optional Hopper, Ghidra, IDA installs for native depth.

The README also carries a supply-chain warning: similar repository names or copied READMEs do not prove a download is official—use morluto/rea, rea.tools, or rea-agents on npm.

How an agent session uses REA

1. You (or a script) run npx rea-agents setup and approve MCP registration.
2. The agent receives dozens of RE tools (catalog badges on the repo cite a large MCP tool count).
3. You ask a natural-language question (“how does this dialog save settings?”).
4. REA returns evidence-backed findings; the agent may iterate or generate replacement code.

That is legitimate security research and a shortcut for copying proprietary behavior into a greenfield repo—without checking in the original vendor’s license.

Nation-state agents already reverse engineer for exploits

Independent of Intezer’s lab, Anthropic’s September 2026 threat intelligence report documents agentic reverse engineering in the wild. Case GTG-20006—assessed consistent with Midnight Blizzard—stole a proprietary drone vision SDK and spent several days reverse engineering it with Claude. Separately, GTG-10007 ran parallel workstreams, including one dedicated to reverse engineering endpoint security products for new bugs, alongside malware development and standing collection agents. A later agentic espionage case study shows the same pattern at campaign scale with minimal human checkpoints, but the SDK and endpoint-security RE examples above come from the September report.

Those cases are not “developers learning Assembly faster.” They are permissioned agent loops with MCP and shell tools, the same class of surface REA targets on a laptop. Our Mythos 5.2 cyber benchmark write-up covers how frontier cyber scores are rising in labs; this week’s news is that mainstream RE tooling is shipping into every agent IDE.

What this means if you run AI coding agents

1. Treat MCP setup as installing a privileged toolchain

npx rea-agents setup is closer to curl | bash for your agent than to installing a theme. It can:

• Add stdio MCP servers with binary analysis and tracing.
• Drop skills that teach the model when to invoke RE workflows (skills.sh entry is linked from the repo).

Before approving:

npx rea-agents setup --dry-run

Read every path the plan touches (~/.claude, ~/.codex, Cursor MCP config, etc.). Compare with malicious auto-approved hooks patterns you already worry about.

2. Segregate malware and production keys

If REA or a custom Intezer-style harness analyzes malware, run it on a disposable VM without:

• Corporate SSO cookies
• .env files for production
• SSH agents forwarded from your daily driver

Fishbein’s malware harness deliberately avoided execution; your agent might not—especially if prompted to “verify behavior.”

3. Watch for clone-and-ship workflows

Agents excel at translating behavior into new code. Legal and contractual risk sits with your organization, not the model. Pair autonomous coding with 0rwx-style scrutiny labels or human review on anything shipping to customers.

4. Do not confuse client reconstruction with backend safety

Fishbein notes that without exposing server infrastructure to the client, vendors retain a meaningful barrier. Agent operators should assume attackers stop at the boundary that ships to users—exactly where Electron apps leak logic today.

5. Compare open skill scanners

NVIDIA’s SkillSpector and community REA skills both land in the same config directories. Scan before you run unfamiliar install scripts—see why Beam open-sources its scanner philosophy.

What Beam can and cannot do here

Beam is built to watch coding agents, not to replace Ghidra. Concretely:

• Skill and MCP scanning applies 11 heuristics plus a version-pin check to configs you point at—useful for catching unexpected MCP registrations or curl-pipe patterns in skills, but not semantic proof that REA is malicious (it is often intentional).
• PreToolUse deny on Claude Code and Codex can block some destructive shell commands when workspace policy is in enforce mode and policy cache is valid—fail-open if policy is missing or expired.
• Beam does not sandbox Hopper/IDA, does not intercept every agent family equally, and does not stop you from approving a well-formed REA setup you chose.

For a local-first audit trail of what the agent tried after you enabled RE tools, see how Beam watches agent actions and landing sections on what gets recorded.

Legitimate research vs. clone pressure

None of this implies defenders should uninstall disassemblers. Incident responders still need fast answers when a binary lands in a ticket queue, and open MCP bridges can shorten that loop when supervisors stay in the loop. The risk is default-allow agent autonomy: a model that chains decompile → rewrite → commit without a human naming the legal basis or the scope of artifacts that may leave the machine.

Fishbein’s comment that malware authors already leak or recreate successful families as open source aligns with historical worm patterns in AI-adjacent npm packages. AI-assisted RE does not create that incentive—it accelerates it. Security teams should document which workstations may run RE MCP servers, require dry-run setup in change tickets, and store approval hashes for hooks the same way they store code-signing expectations for internal tools.

When Intezer’s full permalink is available on research.intezer.com, compare its harness diagrams with your own agent runbooks: if your runbook only mentions “don’t paste secrets into chat,” it is behind what a motivated outsider can already automate with REA and a weekend of GPU time.

Frequently asked questions

What did Intezer publish on November 10, 2026?

Intezer’s research index listed “When Everything Becomes Open-Source” that day. Secondary reporting attributes to Intezer a demonstration that AI harnesses can reconstruct Slack, Finder, and Turla-class malware behavior with far less manual Assembly work than before.

What is the REA MCP server?

morluto/rea, npm package rea-agents, MCP registry name io.github.morluto/rea—a local reverse-engineering bridge for agents, documented on GitHub.

Does REA upload binaries to the cloud?

Analysis is local; LLM providers still receive tool output in the chat unless you run an entirely offline model stack.

Are nation-states using agents for reverse engineering?

Anthropic’s September 2026 threat intelligence report documents drone SDK reverse engineering (GTG-20006) and endpoint-security product RE in parallel agent workstreams (GTG-10007).

What should I check before running npx rea-agents setup?

Dry-run, verify package provenance, back up configs, and restrict agents on machines that hold production credentials.

Can Beam block reverse-engineering MCP tools automatically?

Beam flags risky patterns and can deny some tool uses on supported agents; it does not remove REA once registered.

Related reading

• Claude Mythos 5.2 cyber benchmarks and CVE rediscovery
• NVIDIA SkillSpector: what agent skill scanners check
• Agent Baseline secure software factory limits outside the agent
• Postman installer self-approved Codex hooks
• Why Beam is open source

Primary sources: morluto/rea · Intezer Research · Anthropic September 2026 threat intelligence report · Dark Reading on Intezer’s AI RE work

Version numbers, MCP client lists, and permalink availability are accurate as of November 10, 2026.