LLM Reverse Engineering and OSS Licenses: What Courts Actually Say

An Ask HN thread on November 8, 2026 poses a hypothetical with real money behind it: if courts declare LLM-assisted reverse engineering illegal, does that open the door to a class action arguing that labs violated open-source licenses by training on public code? The poster contrasts (1) post-training an LLM on decompiled output and (2) using an LLM to read a binary and emit working source, then asks how that differs from a human clean room.

No court has issued the nationwide ban the question assumes. What exists instead is a patchwork: trade-secret law with a reverse-engineering exception, contract law enforcing some EULAs, copyright fair-use cases from the 1990s, ongoing training-data lawsuits, and brand-new disputes over deceptive AI extraction. This article maps what is claimed versus verified so you can reason about risk without treating a thought experiment as settled law.

For hands-on workflow rules, start with our clean-room checklist for REA-style agents. For how licenses attach to weights—not binaries—see our open-weight license explainer.

TL;DR: the parallel is interesting but not automatic

What Hacker News is actually asking

The thread title—"If LLM reverse engineering is deemed illegal, is that precedent for OSS?"—bundles two anxieties builders voiced all year as agentic decompilers went viral.

First, closed-source vendors want to slow automated binary analysis that used to require expert teams. Second, open-source maintainers want leverage over labs that ingested public repos into training corpora without following license conditions. The HN poster wonders whether a win on side A automatically helps side B.

That only works if courts adopt one sweeping theory of "AI reverse engineering." So far they have not. US trade-secret law distinguishes proper reverse engineering of lawfully obtained products from improper means such as bribery, theft, or—as newer filings argue—deceptive prompt injection designed to bypass safeguards.

What developers are saying

The thread is small—3 points and 7 comments as of this writing—but the disagreement is the useful part.

• verdverm asked why anyone expects a ban at all, pushing back on the premise (comment).
• turtleyacht argued licenses bind humans, not models, but that commercial intent to evade restrictions through relicensed LLM output should fail in court; private retrocomputing and repair should stay protected (comment).
• xlayn reductio-ad-absurdum: if reading code with an LLM counts as illegal reverse engineering, ordinary coding agents would be too (comment).

None of these comments are legal authority. They show where practitioners split: human intent, commercial use, and whether inference counts as copying.

What US trade-secret law already says about AI speedups

Goodwin's December 2025 client alert "Reverse Engineering in the Age of AI" (PDF) is explicit that both the Uniform Trade Secrets Act and the federal Defend Trade Secrets Act treat lawful reverse engineering as excluded from "improper means." The firm warns that AI makes extraction faster and may push more information into the "readily ascertainable" bucket, which weakens trade-secret status—but it does not announce a new prohibition category for LLM tools.

That matters for the HN hypothetical: a court would need a statute or contract theory beyond trade secrets to ban generic decompilation. Industry fear campaigns and vendor blog posts are not that.

LLM reverse engineering and OSS licenses shown as an open-source license badge on protected code

Where courts are drawing a harder line: deception, not disassembly

K&L Gates' 2026 Law360 summary of Elliott v. New York Bariatric Group covers what appears to be the first US court sanction tied to prompt injection: pro se plaintiff Matthew Elliott hid white-on-white text in Connecticut court filings instructing any AI reviewer to side with his motion (PDF). Judge Walter Spader treated the concealed instructions as a channel the opposing party cannot see or answer—even though Connecticut's judicial branch did not use AI on those filings.

Goodwin's December 2025 alert separately flags prompt-injection attacks against another company's generative AI platform as a potential trade-secret improper means theory—closer to deceptive extraction than to classic reverse engineering of a product you lawfully obtained.

That is the enforcement shape builders should expect near term: not "Claude read my DLL therefore crime," but deceptive extraction—hidden commands in documents agents ingest, tricks aimed at someone else's model, or scraping behaviors courts have already condemned. You are in a different box than a developer documenting API behavior from a purchased app.

For agent builders, indirect injection in email, tickets, and web pages is the practical cousin of this problem; see our indirect prompt injection guide.

Copyright, EULAs, and why OSS training is a different docket

Kurt Shields' plain-language walkthrough (AI reverse engineering explained) tables the jurisdictional split: US fair-use cases allowed disassembly for interoperability learning in Sega v. Accolade and Sony v. Connectix, but US courts also enforced anti-RE clickwrap terms in Davidson v. Jung. The EU Software Directive and UK CDPA grant decompilation rights for interoperability that contracts cannot waive.

None of those cases mention LLMs, but they show the axis: what you obtained lawfully, what you publish afterward, and which license you clicked.

Open-source training litigation, meanwhile, targets copying source files into datasets and compliance with attribution or share-alike terms—the fight that produced high-profile GitHub Copilot challenges and similar suits. Those complaints do not need a future ban on binary decompilation; they allege ordinary license breach and copyright theories already.

So the HN class-action fantasy skips a step. A ruling against binary rebuild bots would not automatically import GPL or Apache conditions into weight training unless a judge explicitly connects them—and nothing today suggests one precedent will collapse the two industries' arguments into a single sentence.

Clean rooms when the "analyst" is an LLM

Traditional clean-room reverse engineering separates:

1. A dirty team that studies the product and writes behavioral specs without handing over code.
2. A clean team that implements from specs alone.

When the dirty team is an LLM, the workflow questions are procedural, not mystical:

• Provenance: Did you feed the model proprietary code or only observations from running the binary?
• Output hygiene: Are you publishing decompiled text, or merely using understanding to write new code?
• Model contamination: If the same model was fine-tuned on the target binary, can you prove the clean implementation team never saw weights tuned on secrets?

Our Snowboard Kids 2 agent decompilation write-up shows how far agents get—and where human verification still gates shipping. BLA's open-source tooling is the vendor-side response: make agent reverse engineering fail on protected clients, which is a technical countermove, not a statute.

Researchers are also quantifying how cheap binary analysis became. The October 2026 preprint "Cheap Reverse Engineering and What It Will Do" (arXiv:2610.35633) reports benchmark costs per binary falling sharply as frontier models improve—fuel for policy panic, but still an economics paper, not a court order.

Clean-room reverse engineering workflow split between binary study and independent implementation teams

What a clampdown could look like (claimed vs verified)

If Congress or a regulator ever proposes a targeted ban, watch who lobbies for it (game publishers, security SaaS, foundation model vendors) and whether text distinguishes interoperability research from automated cloning for hire. Until then, compliance work stays granular: honor the product EULA, honor the OSS license on code you copy, and document separation of duties.

What this means if you build agents or study binaries

If you analyze closed products: Start from a lawful copy, keep notes like a human RE shop would, and never redistribute extracted code or art. US readers should assume clickwrap bans may bind you even when copyright fair use might favor research.

If you train or fine-tune on GitHub: Treat license files as binding on copied expression, not on abstract ideas learned from binaries. The obligations in our open-weight license guide apply to publishing checkpoints, not to privately studying a game mod.

If you sell RE-as-a-service: Deceptive extraction and Terms-of-Service violations are the near-term litigation magnets, not the mere fact that an LLM disassembled faster than IDA Pro.

What people are asking next

Would a GPL lawsuit succeed just because a lab also blocks binary RE bots? Probably not without proving GPL copying and distribution of source. Political alignment between vendor campaigns does not create a legal confession.

Does posting a reconstructed repo trigger DMCA like Take-Two's re3 suit? Publishing decompiled source is where many hobbyist projects attracted counsel, even when downloads eventually settled. Keeping rebuilds private and clean-room documented reduces—but does not eliminate—risk.

Are agent skills like REA inherently unlawful? Skills are automation. Lawfulness still depends on the target software's license and your outputs. Read the skill author's disclaimers and our REA MCP security notes before pointing agents at third-party binaries.

Related reading

• Is AI reverse engineering legal? Clean-room checklist
• Open-weight AI model licenses explained
• How far agents get decompiling Snowboard Kids 2
• BLA: blocking agent reverse engineering on clients
• Indirect prompt injection for agents
• REA MCP server and agent security
• Prove an AI reverse engineering result with tests

Case citations, arXiv versions, and HN comment counts are accurate as of November 8, 2026. This article is general information, not legal advice.