A Prompt Library Is Teaching AI Agents to Stop Guessing

Every so often the interesting artifact in a hyped ecosystem is not the tool but the instructions people wrote for using it. REA-Prompts, a repository by JoasASantos on GitHub, is exactly that: a curated collection of prompts for REA — Reverse Engineer Anything — a toolset that lets an AI coding agent inspect how software works, from native binaries, firmware, and kernels to games, Electron apps, APKs, and websites. The repo contains no code. It is MIT-licensed text. And it may still be the most instructive thing in the current wave of AI-assisted reverse engineering, because what it encodes is not capability but discipline.

The wave it rode in on

The attention spike is easy to trace. An X thread by codila, titled “REA is the most dangerous thing on the internet right now,” quoted Matthew Berman and put REA in front of an audience primed to hear that software’s last black boxes were being pried open. Around the same time, Md Ismail Šojal promoted the REA-Prompts collection directly, describing it as ready-to-use prompts that help AI agents reverse engineer software “properly instead of guessing” — genuinely understanding binaries, apps, and firmware rather than making assumptions about them. That framing, agents that guess versus agents that know, is the entire thesis of the repository, compressed into a promotional post.

There is apparently a broader conversation happening — Reddit threads on r/OutOfTheLoop and r/ReverseEngineering about the recent surge of AI reverse engineering exist — but both were blocked at retrieval time, so the shape of the community debate is genuinely unclear. What is clear is the commercial context: this is a moment where reverse engineering is being rebuilt around agents.

What the repository actually is

Let’s be honest about the artifact, because the honesty matters. REA-Prompts is a prompt collection — organized, curated, generously credited (the REAP name is attributed to a third party, the tooling to rea.tools, the gallery of real investigations to madewithrea.com), but a prompt collection. It is not even glue code; glue code at least runs. It is documentation for someone else’s product, structured into seventeen sections spanning feature tracing, native binaries, software cloning, games, WASM porting, firmware, Android, kernels, vulnerability research, Electron, anti-cheat, DMA hardware attacks, cracking research, and long-running investigations.

And yet dismissing it as a prompt dump misses the point, because the prompts are not interchangeable boilerplate. Read closely, they constitute a methodology — a set of rules about what counts as knowing something when your analyst is a language model that would rather answer confidently than correctly.

The epistemics hiding in the boring part

The repository’s own “prompt-writing tips” section is the real paper hidden inside the product. Six rules, each aimed at a specific failure mode of agentic analysis:

One feature per prompt, because broad “explain the whole app” questions return shallow maps while narrow ones return call chains and addresses. Demand evidence — every prompt requires file, function, or address citations, which the author bluntly says “stops the agent from confabulating.” Separate fact, inference, and unknown into three buckets. Static analysis first, with explicit instructions not to execute the target until runtime observation is actually needed. End with a deliverable — a specification file, a reader, a port plan — because a concrete artifact forces the agent to verify its own claims. And state the scope out loud: “lab machine I own,” “offline single-player,” “document, don’t bypass.”

This is not prompt engineering as the term is usually deployed — tricking a model into a better tone. It is an epistemic contract. The prompts systematically refuse to let the agent produce the thing language models most naturally produce: fluent, confident narrative unmoored from evidence. The three-bucket structure in particular is quietly radical. Most tooling treats unknowns as failures; these prompts treat them as first-class outputs, things to be listed and prioritized rather than papered over.

The boring part — the repeated, almost legalistic demands for addresses and evidence chains — is where the value lives. It is the difference between an agent that says “the app probably validates the license locally” and one that says “the validation routine sits at this address, this is confirmed from the decompilation, and whether the result is cached across restarts remains unknown.”

Why the discipline is not optional

If that sounds like overkill, the surrounding literature suggests it is barely enough.

Thoughtworks ran a black-box reverse engineering experiment — published in June 2025 — asking whether generative AI could rebuild an application’s specification without access to source code, using only the UI, the database, and network traffic. The sobering finding: a single agent run traced a suspiciously simple linear happy path. Running the agent multiple times uncovered different branches each time, and a separate convergence step was needed to merge the runs into a realistic flow map. One pass through a system, in other words, is not analysis; it is a sample. The REA-Prompts approach of narrow, repeated, evidence-anchored queries is a reasonable response to exactly this failure mode.

More alarming is the adversarial angle. An arXiv paper from May 2026 demonstrates a genetic-algorithm-based prompt injection attack against LLM-powered disassembly and decompilation agents: extraneous string variable assignments inside a binary can pass surreptitious instructions to the analyzing model without affecting the executable’s functionality, corrupting its analytical output. The attack surface of agentic reverse engineering is the agent’s trust in what it reads. A methodology that demands every conclusion be tied to a specific function, address, or captured artifact — and that separates confirmed facts from hypotheses — is not just good hygiene here; it is a partial defense against binaries that lie to their analysts. Not a complete one, since a cleverly injected string can cite a fake address as easily as a real one, but it raises the cost of deception.

There is also the mundane failure mode: agents that loop. A separate Ghidra-based project, biniamf’s Rev·Deck — a Flask-and-LLM copilot over headless Ghidra — recently added hard step budgets precisely because a looping model could otherwise drain an API key. Notably, Rev·Deck’s own pitch includes “evidence-first Analysis views” and workflows that “cite evidence.” Two independent projects converging on evidence-first design is not coincidence; it is the field discovering, independently, what REA-Prompts wrote down.

Where this sits in the landscape

The commercial end of the same trend is RevEng.AI, a binary intelligence platform that analyzes compiled software without source, symbols, or sandboxing, claiming a corpus of over 1.4 billion analyzed binaries, a median end-to-end analysis time of 183 seconds, and customers including defense contractors and allied governments. Its capabilities — agentic malware analysis, semantic code search across binaries, AI decompilation — describe a world where reverse engineering is no longer artisanal work performed one binary at a time in IDA Pro, but a bulk, automated, model-driven process.

REA and its prompt collection occupy the opposite end: the consumer, agent-native end, where the analyst is whoever has a coding agent and a question. The prompts are the interface layer — the part that translates “I want to know how this feature works” into a request an agent can execute without embarrassing itself. That layer matters. RevEng.AI can sell sovereign, air-gapped deployment to NATO; the rest of the ecosystem needs the methodology to be written down somewhere, and a public MIT-licensed repository is a reasonable place for it to live.

The ethics scaffolding, and its seams

The repository is unusually explicit about scope. A warning at the top restricts use to software you own or are explicitly authorized to test, and frames the anti-cheat, DMA, kernel, and vulnerability prompts around security research, interoperability, CTFs, bug bounties, and testing your own protections. The DMA section — hardware-assisted cheat research — is pointedly defensive: studying how detection works, hardening your own product, with a note that reading another machine’s memory over PCIe without authorization is illegal in most jurisdictions. The cracking section is titled “document, don’t bypass.” The cloning section specifies clean-room methodology: extract behavior, never code, assets, branding, or licensing mechanisms.

The scaffolding is genuine and more thorough than most security tooling bothers with. It is also, structurally, load-bearing in a way the author probably intends: the same prompt that documents a license-validation algorithm for interoperability purposes produces, with one additional sentence, a specification from which a keygen could be built. The repository’s answer is scoping language baked into the prompt itself — the framing travels with the request. Whether that travels far enough is the open question, and the repo does not pretend to have closed it.

What we don’t know

The honest limits are worth stating. There are no benchmarks here — no evidence that these prompts outperform naive ones, though the confabulation problem they address is well documented enough that the hypothesis is at least plausible. The prompts hedge constantly against their own substrate: “if available” appears repeatedly, referring to REA workflows like version comparison, residual-unknown auditing, and reconstruction verification that may or may not exist in a given install. The collection is documentation for a moving product; if REA changes, the prompts rot.

Community reception is unverifiable from here — the Reddit discussions were inaccessible, and the promotional X post shows modest reach. And the repository’s dependence on REA means its fate is not its own: it is a methodology wearing another project’s clothes.

Outlook

The interesting bet embedded in REA-Prompts is that prompt collections are the durable layer. Tools churn; REA may be displaced by whatever comes next, and the commercial platforms will keep consolidating. But the rules — one feature per question, evidence or it didn’t happen, three buckets for certainty, static before dynamic, end with an artifact — apply to any agent that reads binaries. The madewithrea.com gallery, which collects real investigations and rebuilds sorted by use case, is the test: if the artifacts people produce with these prompts hold up, the methodology earns its keep. If they turn out to be fluently cited confabulations, the three-bucket format was always just a well-organized way of being wrong.

The safer wager is on the middle: agents that guess less, cite more, and know exactly what they still don’t know. That is a smaller revolution than the hype thread promised — and considerably more useful.