Skip to content

Is Claude blocking reverse engineering?

What changed in October 2026, why some REA sessions stop or get weaker answers, and what still works. With links to Anthropic's own pages.

Updated Oct 24, 2026

A Reddit post claimed Anthropic "secretly killed" REA: Claude stops mid-answer when asked to write an REA guide, and gives underwhelming results on reverse-engineering work. Part of that is real. The explanation in the post is not.

Two Claude replies: one says a safety check stopped the response partway through a playbook and it can't produce the write-up again, even reworded; the other refuses to finish the document for the same reason.
The screenshot shared in the Reddit post: Claude stopping a REA playbook partway through.

What actually changed

On October 6, 2026 Anthropic expanded its Cyber Verification Program and described the cyber safeguards on its generally available models as conservative, blocking most cyber work. Anthropic's help pages say malware analysis and exploit validation may be interrupted, while secure code review, threat modeling and finding vulnerabilities in your own source code are fine.

These checks run on every request, including what Claude reads: web search results, files and connectors. So research that pulls in material about breaking into binaries can trip a check partway through an answer, which matches the "stopped mid-sentence" screenshots. After a stop, Claude won't produce the same content again, even reworded.

Why some answers feel weaker

This is the part the post gets wrong. Claude is not told to do a bad job. Instead, for offensive requests such as exploit generation, penetration testing and binary-based vulnerability scanning, Opus 5 and Opus 5.5 hand the request to a less capable model (Opus 4.8). The answer really is weaker, because a different model wrote it.

It is not secret either. Anthropic says each switch shows a notice and every response is labelled with the model that answered. The notice is easy to miss in a long session.

What still works

  • Studying how a feature behaves and rebuilding it cleanly: most builds in this directory are exactly that.
  • Understanding file formats and protocols, including on devices you own.
  • Reviewing and fixing your own code, binaries and apps.
  • Most requests: Anthropic says most of them never hit a fallback at all.

If your work keeps getting stopped

  1. Say what you are allowed to analyse and why: "my own device", "software my team maintains", "defensive review".
  2. Watch for the model-switch notice. In Claude Code you can turn automatic switching off under Config, MODEL & OUTPUT, so you get a clear stop instead of a quieter, weaker answer.
  3. If you do security work for a living, apply to Anthropic's Cyber Verification Program. Its Defense Access tier covers tasks such as reverse-engineering malware.
  4. REA is not tied to Claude: it also runs in Codex, Gemini CLI, Cursor and other agent hosts.

REA itself is very much alive: its repository was getting dozens of commits a day when this was written, and new builds keep arriving here.

Sources