Using REA with Claude and other AI models: what's fine, what needs permission, and where are the legal lines?

[CassieFox23]

TL;DR: Your own code, open-source code, malware in a sandbox and CTF (capture the flag) puzzles are generally fine. Trouble starts when you copy someone's software, break copy locks (DRM), or break into systems you don't own. Claude's safety checks are broad and may stop real work, and the steps below help.

I'm a hobbyist who tests REA, not a lawyer, and this is not legal advice. I asked Claude Code (Opus 5.5) to read the sources and draft this post. It quoted only pages it fetched.

Why I'm asking

REA lets your AI agent look inside a program when you don't have its source code. Some people say their agent stops on REA work. In #2095, Claude Code and two other agents keep hitting blocks. In #2027, Cursor, another AI editor, keeps saying no. Their prompts aren't shown, so this post doesn't guess why.

If Claude says no

Anthropic made its safety checks broad on purpose. Its Claude Code error page says they "can sometimes flag" real security work. What helps:

• Say what you own and why: "This is my own build." "This is a CTF binary."
• Keep the ask small: one function, one format, one question.
• Ask to understand: "help me understand this" more than "rebuild this".
• Leave out keys and locks. No license keys, and no asks to get past license checks or DRM (digital rights management).
• Give true context, not a cover story. Calling a crack "my own build" is a trick. REA and Anthropic both ban tricks to get past a model's guardrails.

If you get blocked:

• Step back, don't resend. The check reads the whole chat. In Claude Code, press Esc twice or run /rewind, then rephrase.
• Report a false flag with /feedback.
• Security work for a living? Apply to the Cyber Verification Program. Individuals can apply on a paid plan, for its Defense Access tier only.

Traffic lights

Green: generally fine. REA's disclaimer allows broad uses like these:

• Your own programs, and their crash dumps.
• Open-source programs, when you only have the built file.
• Malware samples, in a VM or sandbox. Anthropic warns this work "may be interrupted".
• CTF puzzles, which are made to be taken apart.
• Save files and file formats of a single-player game you own.
• What an app on your own device sends, from a saved traffic capture.
• Good-faith security research on a device you own. US lock rules (the DMCA) have an exemption for it.

Yellow: it depends on the license, your country and what you do with the result.

• Modding a single-player game by changing its code. Reading its save files is green. Changing the game brings in its license and any lock on it.
• Fixing a bug in a program you bought.
• Changing how your own device works, like a printer that refuses cheaper ink (see Details).

Yellow: get permission first.

• Pentests and bug bounties. Get the owner's permission in writing, or follow the bounty's rules. Anthropic's new policy says it "does not prohibit security research" done this way. That text starts November 12, 2026. Today's version, from September 15, 2025, has no such line.
• An employer's or client's software. Get the scope in writing.
• Other people's servers and online services. In the US, the main law on computer crime (the CFAA) covers access "without authorization".

Red: against REA's own rules (its disclaimer).

• Selling or posting a rebuilt copy of someone else's software.
• Cracking license checks or DRM.
• Game cheats, or getting past anti-cheat.
• Tampering with an online game or service.
• Breaking into systems you have no permission to test.
• Spreading malware to hurt people.

The laws behind these differ by country. Anthropic's policy, today's and the new one, also bans malware and break-ins.

Outside the US

Place	What's different	Law
EU	Within limits, you may study, test, and decompile a program to work with yours or to fix bugs. A contract can't ban these. For bug fixes, a contract can set terms.	Art. 5, Art. 6, Top System
UK	Much like the EU. Selling tools that get past a program's lock can get you sued.	s.50B, s.296
Canada	You may get past a lock so things work together, or to repair them.	s.41.12, s.41.121
Australia	You may copy a program to make a product that works with it. Lock rules allow that, and security tests with the owner's permission.	Copyright Act (3.2 MB)
Japan	Use that isn't for enjoying a work is allowed, within limits. No source found says how courts apply that to reverse engineering.	Art. 30-4
China	You may study a program's design while using it. You may get past a lock for research or security tests, but not hand out the tools.	Art. 17, Art. 50
Brazil	Its software law's list of free uses doesn't name reverse engineering. Other laws weren't checked.	Art. 6
Chile	You may reverse engineer a legal copy so programs work together, or for research. Security tests are allowed too.	Art. 71 Ñ

Laws change, so check your own country's current text. Japan's and China's laws were read in English translations. Brazil's and Chile's were translated for this post.

Your turn

What do you use REA for? Has Claude stopped you on something that seemed fine? Share the use case, but no private files or keys. Corrections are welcome, most of all on law outside the US.

Other model makers, from OpenAI to Qwen, are in the comment below.

Details (tap to open)

Claude's checks: what they read, and the policy dates

• Anthropic's page on Opus 5 and 5.5 says what the checks read. They "review everything the model reads, not just your latest message". That includes "files" and "content from connectors". Not tested: text REA pulls out of a program could trip a check.
• The Usage Policy page shows "Effective November 12, 2026". Until then, the September 15, 2025 version is in force. Only the new text says a block "does not by itself indicate a violation". Only the new text says it "does not prohibit security research". That covers your own systems, work with the owner's permission, and bug bounties.

REA tools for the green uses

• open_binary opens a program file to analyze.
• inspect_recorded_crash reads a Linux core file, the snapshot a crash leaves behind. It doesn't run the program.
• inspect_artifact looks inside an archive or app package.
• inspect_managed_artifact lists what's inside a .NET program file, without running it.
• inspect_web_network_capture reads a saved traffic capture (HAR or mitmproxy). It doesn't contact the sites in it.

Printer example: a printer that refuses cheaper ink (US law)

#1989 asks about a printer that refuses cheaper ink. Under US law only:

Step	Light (US)
Study the firmware or update file to learn how the cartridge check works	Green. If the firmware is encrypted, decrypting it can count as getting past a lock.
Patch your own printer to take other cartridges	Yellow. No exemption names ink printers, and the repair rule's text doesn't say.
Share or sell a patch or tool that does it	Red

• Why yellow and red: patching gets past a lock, which US law bans unless an exemption fits. Sharing a tool is banned on its own.
• Study: this is learning. But the law counts decrypting as getting past a lock.
• Patch: the ban is 17 U.S.C. §1201(a)(1), part of the DMCA. The 2024 exemption list names 3D printers that limit material, not ink or toner printers. There is also a repair rule for devices people buy for home use. Its text doesn't say if it reaches cartridge checks.
• Share: tools are banned by §1201(a)(2) and (b). The exemption list doesn't cover tools. A narrow path in §1201(f) allows tools made only so programs can work together. It depends on the facts.
• Lexmark v. Static Control (2004): a court lifted an order against a maker of replacement cartridge chips. It said buying the printer, not the chip check, is what gave access to the printer's code. That was an early ruling on those facts only.
• Impression Products v. Lexmark (2017): once the maker sells a cartridge, its patents give it no more say over that cartridge. That case is about patents, not locks.
• Neither case makes patching safe. Outside the US, the EU, the UK, Canada and Australia also have lock rules, each with their own exceptions.

US cases, plus fair use, trade secrets and clean room

• Fair use is a US defense for some copying.
• Sega v. Accolade (1992): taking code apart to learn how to work with a console was fair use. It needed a real reason and no other way in. It didn't cover the final product.
• Sony v. Connectix (2000): copies made to take apart a console's start-up code, so as to build an emulator, were fair use.
• Bowers v. Baystate (2003): a license that came in the box banned reverse engineering. The court held the buyer to it as a contract. One judge disagreed in part. In the EU, UK and Australia, some such contract terms are void.
• MDY v. Blizzard (2010): the maker of a bot for an online game was liable for selling a tool that got past the game's anti-cheat check. Just breaking the game's rules was not a copyright breach by itself.
• Van Buren v. United States (2021): you "exceed authorized access" if you get into areas, like files, that are off-limits to you. A bad motive alone doesn't count.
• Trade secrets: US law says reverse engineering is not an "improper means" of getting one.
• Clean room: one person studies the original and writes a spec. Another writes new code from the spec only. The Sega court said it aims "to prevent direct copying". The first person may still need to take the code apart. Issue [Design] Copyright compliance concerns regarding agent access to original source code #2120 asks REA for a "copyright-conscious mode" to help with this.

Outside the US: section numbers, for checking

• EU: Software Directive 2009/24/EC. Study and test: Art. 5(3). Decompile to work with other programs: Art. 6. It covers only the parts you need. You can't share what you learn, except to make things work together, or use it for a similar program. Contract terms against Art. 5(3) or Art. 6 are void: Art. 8. Tools made only to get past a program's lock: Art. 7(1)(c).
• EU, locks: for other works, like music or films, 2001/29/EC Art. 6 bans getting past locks and selling tools for it. Its recital 50, a note at the top of that law, leaves program locks to the Software Directive.
• EU, bug fixes: Top System, case C-13/20 (2021). A buyer may decompile to fix bugs, only as far as needed. A contract can set terms for that but can't ban it.
• UK: CDPA 1988 s.50B (decompile), s.50BA (study and test), s.296A (contract bans void), s.296 (lock tools).
• Canada: Copyright Act s.41.12 (work together), widened to devices, and the new s.41.121 (repair). Both came from laws passed on 7 November 2024.
• Australia: Copyright Act 1968 (one 3.2 MB page) s.47D, s.47H (no contract override), s.116AN(3) and (5). A repair rule is in the Copyright Regulations 2017, reg 40.
• Japan: Copyright Act Art. 30-4, and Art. 113(6), which allows research on locks. The official English text is a 2021 version. It says it is not legally binding.
• China: English from WIPO Lex. Software rules (2013) Art. 17 lets you study design while you use a program. Copyright Law (2020) Art. 49 bans getting past locks, and Art. 50 lists the exceptions, but you can't hand out the tools. A 2020 Supreme People's Court rule, Art. 14, says it is not trade secret theft to reverse engineer a product you got through public channels. That fails if you first got the secret by improper means. No official English was found for that rule, so that summary is a translation made for this post.
• Brazil: Lei 9.609/1998 Art. 6 allows fitting a program into your system for your own use. Under Lei 9.610/1998 Art. 107, you pay damages for removing copy locks.
• Chile: Ley 17.336 Art. 71 Ñ, from 2010. Point (b) lets you reverse engineer a legal copy so programs work together, or for research. Point (c) allows testing, checking or fixing how a legal copy works, or its security. You can't use what you learn to make a similar program that breaks the law. No lock ban was found in the copyright law. A bill to add lock rules is in the Senate.

Sources: REA, Anthropic and the law

REA:

• DISCLAIMER.md
• CONTRIBUTING.md, scope

Anthropic:

• Usage Policy, from November 12, 2026
• Usage Policy, September 2025, in force today
• Agents and the policy
• Cyber safeguards and CVP
• Opus model switching
• Claude Code errors

US:

• 17 U.S.C. §1201
• 37 CFR §201.40
• 18 U.S.C. §1030
• 18 U.S.C. §1839
• Sega v. Accolade
• Sony v. Connectix
• Bowers v. Baystate
• MDY v. Blizzard
• Van Buren
• Lexmark v. Static Control
• Impression Products

Outside the US:

• EU 2009/24/EC Art. 5, Art. 6, Art. 7, Art. 8
• EU 2001/29/EC
• Top System
• UK s.50B, s.50BA, s.296, s.296A
• Canada s.41.12, s.41.121
• Australia, regulations
• Japan
• China software rules, Copyright Law, court rule, Chinese
• Brazil 9.609, Brazil 9.610
• Chile, Chile bill

🤖 Generated with Claude Code (Opus 5.5) 🦊

[CassieFox23]

TL;DR: The lines from the post above mostly hold for other model makers. No policy Claude read names DRM or game cheats, but REA's own disclaimer does. The makers differ on security research, and on whether a real-time scan of your chat can stop you.

Claude Code (Opus 5.5) read each maker's own page, except OpenAI's, on October 12, 2026. Each row shows its page's date.

Maker	Security research	Scans your chat live?	Policy
Anthropic (Claude)	Not stated today. From Nov 12, 2026: not banned, with the owner's permission	Yes	Anthropic Usage Policy, Nov 2026
OpenAI (GPT), secondhand	Via its cyber program (system card)	Yes	OpenAI policies, Oct 2025
Google (Gemini API)	Not stated	Yes	Gemini API terms, Mar 2026
xAI (Grok)	Not stated	Mentions guardrails	xAI use policy, Aug 2026
Mistral (hosted)	Not stated	Mentions filters	Mistral use policy, Jun 2026
DeepSeek (hosted)	Not stated	Mentions filters	DeepSeek terms of use, Mar 2026
Meta (Llama 4)	Not stated	None if run locally	Llama 4 use policy, no date
Google (Gemma 1 to 3)	Not stated	None if run locally	Gemma use policy, Feb 2024
Google (Gemma 4)	No use policy	None if run locally	Gemma 4 license, Apache-2.0, Apr 2026
Alibaba (Qwen3.8-27B)	No use policy	None if run locally	Its license, Apache-2.0

• Scans your chat live means a real-time check that can stop the model. Anthropic, OpenAI and Google say theirs can block. "Mentions" means the page names filters or guardrails but not what they block.
• "Not stated" means no line allows security research. That is not a ban. Only Anthropic's new text has such a line, and it starts November 12, 2026. Today's version, from September 15, 2025, doesn't. Google's says it "may make exceptions" for science or teaching.
• OpenAI's row is secondhand. Its policy page blocked direct reads, so its date and quoted lines come from a search index. The rest comes from its GPT-5.5 system card, read directly. The card calls malware work and hunting for flaws "critical for defenders".

Running a model yourself

Open weights are model files you download and run on your own machine. Then nothing scans your chat, but the law still applies, and so does any use policy in the license. Llama 4 and Gemma 1 to 3 come with one. Gemma 4, Qwen3.8-27B and DeepSeek V4.1 don't. Their open-source licenses, Apache-2.0 and MIT, have no use rules. I run Qwen3.8-27B with REA (my setup is in #2006). So for me, the red lines rest on the law and on REA's own rules.

Do you use one of these models with REA? If you can open OpenAI's policy page, a check of its row would help.

Details (tap to open)

More notes on the table

• Reverse engineering bans cover only the maker's own service. That holds in the Gemini, Grok and DeepSeek terms. They say nothing about using the model to study other software.
• Gemma 1 to 3 run on your own machine. Still, their terms let Google "restrict (remotely or otherwise)" use it thinks breaks them. They don't say how.
• AI editors and agent tools add their own layer. REA's skill notes say the agent tool "can independently require approval".

Exact words, by maker

Claude copied these from each page on October 12, 2026, except where marked. "..." marks a cut. Lines are wrapped short to fit a phone. The words are unchanged.

OpenAI, GPT-5.5 system card, cyber safeguards (April 23, 2026):

pairs live restrictions on especially
risky cyber assistance (through both
monitors and refusals)

workflows such as penetration testing,
malware analysis, and vulnerability
research are both critical for defenders

encourage them to join our Trusted
Access for Cyber program

OpenAI, usage policies (October 29, 2025). The page blocks direct reads, so these lines come from a search index, not a direct read:

destruction, compromise, or breach of
another's system or property, including
malicious or abusive cyber activity or
attempts to infringe on intellectual
property rights of others

circumventing our safeguards

Google, Gemini API terms (March 23, 2026):

You also may not attempt to reverse
engineer, extract or replicate any
component of the Services, including the
underlying data or models (e.g.,
parameter weights).

The Services include safety features to
block harmful content, such as content
that violates our Prohibited Use Policy.
You may not attempt to bypass these
protective measures or use content that
violates the API Terms or these
Additional Terms.

When using agentic services, including
the Computer Use API, you are solely
responsible for the actions and tasks
performed by the service, ... You will
not automatically bypass any requests
for human confirmation.

Google, Prohibited Use Policy (December 17, 2024):

Violates the rights of others, including
privacy and intellectual property rights
-- for example, using personal data or
biometrics without legally-required
consent.

Do not compromise the security of
others’ or Google’s services. This
includes generating or distributing
content that facilitates:
  Spam, phishing, or malware.
  Abuse of, harm to, interference with,
  or disruption to Google’s or others’
  infrastructure or services.
  Circumvention of abuse protections or
  safety filters -- for example,
  manipulating the model to contravene
  our policies.

We may make exceptions to these policies
based on educational, documentary,
scientific, or artistic considerations,
or where harms are outweighed by
substantial benefits to the public.

Google, Gemma Prohibited Use Policy (February 21, 2024). The Gemma Terms (April 1, 2026) bind Gemma 1 to 3 to it:

Generate any content, including the
outputs or results generated by Gemma or
Model Derivatives, that infringes,
misappropriates, or otherwise violates
any individual's or entity's rights
(including, but not limited to rights in
copyrighted content).

Generating content for deceptive or
fraudulent activities, scams, phishing,
or malware.

Attempts to override or circumvent
safety filters or intentionally drive
Gemma or Model Derivatives to act in a
manner that contravenes this Gemma
Prohibited Use Policy.

From the Gemma Terms:

The terms below apply to Gemma models
listed in the Appendix at bottom of this
page. For Gemma 4 terms, see the Gemma 4
license.

To the maximum extent permitted by law,
Google reserves the right to restrict
(remotely or otherwise) usage of any of
the Gemma Services that Google
reasonably believes are in violation of
this Agreement.

The Gemma 4 license page holds the Apache-2.0 text and nothing else.

xAI, Acceptable Use Policy (August 14, 2026). The page calls the company "SpaceXSI":

Modifying, copying, translating,
leasing, selling, reselling,
distributing, distilling, manipulating,
using bots to access, reverse engineer,
decompile, disassemble or otherwise seek
to obtain the source code of our
Service, including our systems, models,
or algorithms (except to the extent this
restriction is prohibited by applicable
law)

Introducing viruses or malware, spamming
or DDoSing Services, or bypassing our
systems or protective measures

Violating copyright, trademark, or other
intellectual property law

Engaging in espionage, hacking,
defrauding, defaming, scamming, or
spamming

Respect guardrails and don’t mislead.
Don’t circumvent safeguards unless you
are part of an official Red Team or
otherwise have our official written
consent.

Mistral, Usage Policy (June 11, 2026):

This Usage Policy does not apply to
Mistral AI Products deployed on a
customer’s infrastructure, on the
infrastructure of our partners, or to
our open-source AI models and products.

Content that infringes, misappropriates,
or otherwise violates any third party’s
rights, including intellectual property
rights,

Security Violations. You shall not use
the Mistral AI Products to compromise,
or attempt to compromise, the security
of Mistral AI, the Mistral AI Products,
or any other third party. This includes
creating malware and exploiting
vulnerabilities. You shall not try to
circumvent security protections and AI
safety filters.

DeepSeek, Terms of Use (March 27, 2026). Its API terms (April 29, 2026) point back to these. Items (1) to (3) sit under a heading about the security of DeepSeek's own service:

3.3 To fulfill legal and compliance
requirements, DeepSeek has the right to
use technical means to review the
behavior of users using the Services,
including but not limited to
establishing risk filtering mechanisms,
and creating databases for illegal
content features.

You will not engage in activities that
endanger the security of the Services:
(1) Engage in illegal activities
involving network intrusion, such as:
using unauthorized data or accessing
unauthorized servers/accounts; forging
TCP/IP packet names or partial names;
attempting to probe, scan, or test
vulnerabilities in the software system
or network without permission.
(2) Engage in activities that disrupt or
damage the normal operation of the
network, such as: intentionally
generating, spreading malicious programs
or viruses; ...
(3) Engage in activities to steal
network data, such as: reverse
engineering, reverse assembly, reverse
compilation, translation, or attempting
to discover the source code, models,
algorithms, and system source code or
underlying components of the software in
any way; ...

3.6 You will not use the Services for
the following improper purposes:
(3) Engaging in activities that infringe
on intellectual property rights, trade
secrets, and other violations of
business ethics, ...

Meta, Llama 4 Acceptable Use Policy (no date on the page). The Llama 4 license (April 5, 2025) makes it part of the deal:

f. Engage in or facilitate any action or
generate any content that infringes,
misappropriates, or otherwise violates
any third-party rights, including the
outputs or results of any products or
services using the Llama Materials

g. Create, generate, or facilitate the
creation of malicious code, malware,
computer viruses or do anything else
that could disable, overburden,
interfere with or impair the proper
working, integrity, operation or
appearance of a website or computer
system

h. Engage in any action, or facilitate
any action, to intentionally circumvent
or remove usage restrictions or other
safety measures, or to enable
functionality disabled by Meta

From the Llama 4 license:

Your use of the Llama Materials must
comply with applicable laws and
regulations (including trade compliance
laws and regulations) and adhere to the
Acceptable Use Policy for the Llama
Materials (available at
https://developer.meta.com/ai/llama4/use-policy),
which is hereby incorporated by
reference into this Agreement.

Meta's newer open model, Muse Glimmer, is Apache-2.0. A separate usage policy file sits beside it. Its license file does not mention that policy:

You should not use, or allow others to
use, Muse Glimmer to:
...
Create, generate, or facilitate the
creation of malicious code, malware,
computer viruses or do anything else
that could disable, overburden,
interfere with or impair the proper
working, integrity, operation or
appearance of a website or computer
system

Alibaba, Qwen. Qwen3.8-27B is Apache-2.0. Some newer Qwen weights use the Qwen Community License 1.0. Its only use rule is this:

THE USE OF THE SOFTWARE MUST COMPLY WITH
APPLICABLE LAWS AND REGULATIONS, AND
MUST NOT INFRINGE THE INTELLECTUAL
PROPERTY RIGHTS OF ANY THIRD PARTY.

Sources for the other makers

Anthropic:

• Usage Policy, from November 12, 2026
• Usage Policy, September 2025, in force today

OpenAI:

• Usage policies (blocks direct reads)
• GPT-5.5 system card, cyber safeguards

Google:

• Gemini API terms
• Prohibited Use Policy
• Gemma Terms
• Gemma Prohibited Use Policy
• Gemma 4 license

xAI:

• Acceptable Use Policy

Mistral:

• Usage Policy

DeepSeek:

• Terms of Use
• Open Platform terms
• DeepSeek V4.1 Flash license

Meta:

• Llama 4 Acceptable Use Policy
• Llama 4 license
• Muse Glimmer usage policy

Alibaba:

• Qwen3.8-27B license
• Qwen Community License 1.0

REA:

• Skill notes

🤖 Generated with Claude Code (Opus 5.5) 🦊