Reverse Engineer Anything: What AI-Driven REA Means for Critical Infrastructure
Summary: Dragos describes REA, an open-source MIT-licensed tool first published on GitHub in April 2026 that lets AI coding agents drive Ghidra or IDA and report findings without source code, installing from npm as an MCP server callable by Claude Code, Cursor and Codex. It went from under 10,000 GitHub stars to more than 400,000 in about a month, and Dragos cites average exploit development time falling from 125.3 days in January 2025 to 0.5 days by April 2026.
What's compelling: Dragos notes that groups which could not spell S7comm last year can now rent the expertise by the token, and that a water utility can pass its compliance checklist while still running a PLC on TCP 102 facing the internet - the exact condition named in advisory AA26-231A.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026