AI Reverse Engineering: The Fine Gray Line Between Internal Tools and Copyright Infringement

Using AI to dissect someone else's software—observing, decompiling, and then rebuilding it—has never been cheaper or faster. The short answer to whether it's legal is: ideas and functionality are generally free to study, but source code, assets, and the terms you agreed to are not. The boundary between a harmless internal tool and a copyright infringement lawsuit lies in what you take, how you take it, and what you do with it—not in the label "internal tool."

What Is Happening with AI Reverse Engineering?#

Reverse engineering is the process of analyzing a finished product to understand how it works—ranging from observing external behavior to decompiling machine code back into readable code.

While this practice has existed for decades, October 2026 demonstrated just how dramatically AI has shifted the paradigm:

• Brandon Thomas's ArtCraft project announced Rust reimplementations of Photoshop, Word, and several other office applications, built using Claude Code. The team claimed a clean-room approach: rules for the AI agent prohibited reading, decompiling, or copying anything inside the original software package, allowing only external observation; WordCraft is based on the open ECMA-376 standard (innFactory). These builds remain in alpha.
• The Reverse Engineer Anything (REA) tool—which pairs AI agents with decompilers like Ghidra—grew from under 10,000 to over 100,000 GitHub stars in roughly a week (ABC News).
• Adobe declined to comment, while Microsoft only confirmed receiving press inquiries. As of mid-October 2026, no known lawsuits have been filed.

What AI changes isn't the legal foundation, but the cost: what once took an engineering team months can now be attempted by a single person in days. And when costs approach zero, the number of people stepping into the gray area skyrockets.

Three Levels of Dissecting Software with AI#

Most legal disputes revolve around levels 2 and 3. Level 1 is essentially what every product team already does when studying competitors.

What Does the Law Say?#

The following is a summary for founder orientation, not formal legal advice.

In Vietnam#

• Computer programs are protected like literary works, whether in source code or machine code form (Article 22, Intellectual Property Law).
• The "free copying" exception does not apply to computer programs. Lawful users may only make a single backup copy to replace a damaged original, and cannot transfer it to others (Article 25, amended in 2022).
• The law contains no explicit provision permitting reverse engineering for interoperability like in Europe. This means the gray area in Vietnam is even wider.
• Regarding trade secrets, Article 125 allows disclosing and using information obtained from analyzing and evaluating legitimately distributed products—provided that the analyzer has no agreement to the contrary with the owner or seller. This condition makes contracts (EULAs, terms of service) a crucial legal barrier.
• Intentionally disabling technological measures protecting copyright (license locks, DRM, etc.) is also an infringement.

In the United States#

• Copyright protects the expression, not the idea, procedure, or method of operation (17 U.S.C. §102(b)).
• In Sega v. Accolade (1992) and Sony v. Connectix (2000), courts held that intermediate decompilation to access functional elements is fair use when it is the only way to do so, serves a legitimate purpose, and the final product contains no original code.
• In Google v. Oracle (2021), the Supreme Court ruled that Google's reuse of the Java API declaring code was fair use.
• The DMCA (Section 1201) prohibits circumventing technological protection measures, with narrow exceptions for interoperability.
• Thaler v. Perlmutter (2025) reaffirmed that works require human authorship—meaning code generated almost entirely by AI may not be protected, even when it's your own product.

In the European Union#

• Under Directive 2009/24/EC, lawful users are entitled to observe, study, and test software to understand underlying ideas; they may decompile when strictly necessary for interoperability, subject to stringent conditions; and contractual terms cannot waive these rights.
• The SAS Institute v World Programming (Court of Justice of the EU, 2012) ruling established that functionality, programming languages, and data file formats are not protected like source code.

The common thread across all three jurisdictions: learning the idea is permitted; taking the expression is not. The difference lies in where each draws the line on decompilation and the binding force of contracts.

Is an "Internal Tool" a Legal Shield?#

Many teams assume: "We're only using it internally and not selling it outside, so it's fine." Reality is more nuanced:

• Infringement can occur at the moment of copying, regardless of distribution.
• Breach of contract does not distinguish between internal and external use. If you agreed to terms prohibiting reverse engineering, internal use remains a breach.
• "Internal" might reduce damages and the likelihood of detection, and in the US could be a favorable factor when weighing fair use—but it does not turn an unlawful act lawful.
• Today's internal tools often become tomorrow's products. When that happens, the "borrowed" code tags along into the commercial product.

For instance, a team might feed a competitor's JavaScript bundle into an AI to "explain" it, then copy the pricing logic straight into an internal tool. Initially, it's just for reference; a few months later, that tool is sold to customers. That is precisely when the gray area turns red.

Traffic Lights for Founders#

🟢 Green — Generally Safe#

• Lawfully testing a product, observing its UI and workflows, then independently designing and rewriting it with your own code.
• Building on open standards and public documentation.
• Integrating via official APIs in compliance with terms.
• Analyzing your own data and systems; authorized security testing.

🟡 Yellow — Gray Area, Check Contracts and Consult Legal Counsel#

• Reverse engineering file formats or protocols to make your software interoperable with legitimately purchased software.
• Leveraging undocumented APIs of a service you use.
• Using AI to rewrite an open-source library and re-license it—similar to the controversy surrounding the chardet library in March 2026.
• Automated scraping of competitor public data.
• Having AI "read" and explain a competitor's client-side code.

🔴 Red — Almost Certainly Infringing#

• Copying or distributing decompiled code or substantial portions of the original code.
• Cracking licenses, bypassing DRM, or generating license keys.
• Reusing someone else's proprietary assets: icons, images, fonts, audio, brand names, and logos.
• Using leaked source code or trade secrets brought over from a previous employer.
• Violating contractual terms prohibiting reverse engineering that you previously agreed to.

If Your Team Uses AI Agents to "Rebuild" Features#

1. Establish rules for the AI agent (in instructions like AGENTS.md): strictly forbid reading, decompiling, or copying executables and assets from other products; permit only external observation and public documentation.
2. Enforce a clean room separation: one person specifies the behavioral requirements, while another person or agent implements them without exposure to the original code.
3. Maintain audit trails: reference sources, prompts, design decisions—these serve as evidence of independent creation.
4. Scan AI outputs using license compliance and code duplication tools before merging into your codebase.
5. Read the terms carefully: both of the product you are studying and of the AI provider you are using.
6. Consult legal counsel before launching a product that is functionally equivalent to a competitor.

On the Flip Side: When Your Product Can Be Cloned in a Weekend#

If AI helps you rebuild competitor software faster, others can do the same to yours. A few defensive principles:

• Keep business logic and secrets out of client-side code; retain them on the server.
• Harden APIs: authentication, rate limiting, anomaly detection.
• Set clear terms of service regarding reverse engineering and AI-driven data extraction; register trademarks to protect assets clones are legally barred from copying.
• Build moats where AI cannot copy: proprietary data, deep integrations and partnerships, distribution channels, service quality, and customer trust.

In an ecosystem like GoMetap, I believe the hardest thing to replicate isn't the UI of a membership card, but the integrations with POS systems, payment partners, and the hard-earned trust of every merchant.

Conclusion#

AI didn't invent a new gray area—it merely widened the existing one and accelerated the timeline. For founders, the rule of thumb remains straightforward: learn the ideas freely, but don't take the code; and "internal use" is not a license.

Three questions to audit your team today:

1. Is your team letting AI inspect competitor code or products without clear guidelines?
2. If a free clone of your product launched tomorrow, why would your customers stay?
3. Do your terms of service explicitly address AI and reverse engineering?

Disclaimer: This article reflects a founder's perspective based on public information, not formal legal advice. For specific scenarios, consult an intellectual property attorney.