Thursday's theme is access. One open-source project gives your agent the tools to open almost any program and explain how a feature works, and it is growing faster than anything on GitHub this year. An enterprise vendor is doing the opposite kind of opening: exposing HR and finance data to outside agents while making sure no agent sees more than the human behind it. In between, a video company says its clips went from one minute to ten, and a game store shipped a launcher it says it vibe-coded.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
REA gives your coding agent a decompiler, and GitHub noticed
Reverse Engineer Anything, at morluto/rea, was created on April 14 of this year. This morning the GitHub API reports 244,735 stars and 61,179 forks under an MIT license, and the project cut release 6.5.0 on October 14, two days after 6.4.0. The pitch is one MCP server. Run npx rea-agents@latest setup, pick your agent (Claude Code, Codex, Cursor, Gemini CLI and about ten others are supported), approve the config changes it shows you, restart, and your agent can inspect native binaries, Electron and JavaScript apps, .NET assemblies, Android APKs, Go and Rust binaries, websites and saved network captures. It returns code, references, evidence and a list of what it could not determine; the agent does the explaining and, if you ask, the rebuilding.
Two details matter before you install it. Deep native analysis rides on an existing Hopper, Ghidra or IDA installation, so the headline demos (Windows Calculator's percent button, a 1996 DOS game's sound panning) need one of those. Static JavaScript and Electron analysis need nothing but Node 22.19 or newer, and there is a one-shot CLI command for it with no MCP setup at all. Analysis runs locally and nothing is uploaded, but the findings go to whichever model your agent uses, which the FAQ says plainly. The README also warns about lookalike repos trading on the name, which tells you how much attention this has.
The attention is not only developer curiosity. Indie developer Popcar wrote this week that AI now decompiles whole games in days, which has produced a wave of native ports of abandoned titles and, in the same breath, means any paid app can be opened and copied against its author's wishes. Simon Willison picked the piece up for both halves of that argument. REA is the convenient front door to exactly that capability, and what you are allowed to point it at depends on the target's license and your jurisdiction, not on the tool.
For builders
Try the free path first: npx -y rea-agents@latest analyze-javascript-application /path/to/an/Electron.app --json on any Electron app already on your machine, no MCP config, no Ghidra. Read the evidence and unknowns fields before you trust the graph. Then, if you keep it, ask one question about one feature ("how does export to CSV work in this app") rather than "clone this"; the narrow prompt is what the project's own showcases do. If you ship a paid app yourself, assume your client code is readable from today and keep the value in the service, the data and the account, not in obscurity.
Story II
Workday ships an MCP server that only sees what you can see
At Workday Rising on October 13, Workday made its Trusted Agent Platform "headless": its MCP server, SQL access to live data, and a shared agent runtime are now generally available, per The New Stack. CTO Gabe Monroy said the server offers 275 read tools and 54 that write or delete. You sign in with your own Workday credentials, and an agent acting for you cannot reach anything your account cannot. Customers can run agents on models from Anthropic, Google, Meta, Mistral, Nvidia and OpenAI, build them from a prompt in Claude Code, Codex or Cursor with Developer Agent, or deploy ones written in LangChain onto the runtime. Workday says customers built more than 500 agents and 6,000 apps on these tools in four months.
The demo Monroy ran is the useful part. An agent wired to a custom MCP server returned job requisitions its user had no business seeing, then moved the wrong employee between teams with no approval. Pointed at a Snowflake copy of the same data, it answered a question about the CTO's salary. Routed through Workday's own server with the user signed in, the same queries returned only what that user was cleared for. "When it fails, it isn't just a wrong answer," he said, "it's a wrong action that nobody approved." Workday's president of product, Gerrit Kazmaier, was candid that building directly on the tools suits "a small set of use cases" without HR or finance domain logic; for the rest, Claude hands off to Sana, Workday's own orchestrator.
For builders
Whatever system you are putting agents in front of, copy the pattern, not the product: the agent inherits a specific user's identity and permissions, every write tool is a separate, countable thing, and there is an audit trail. If your MCP server runs on a service account with broad read access, that is the "headless, the lawless way" demo, and it will eventually do what Monroy's did. Count your read tools and your write tools separately today, and put a human approval on every write until you have logs that prove you do not need one.
Story III
Higgsfield says its videos went from one minute to ten, with GPT-6 Astra doing the coordination
OpenAI published a customer story on October 13 in which Higgsfield CEO Alex Mashrabov says the platform's videos used to top out around one minute and users can now create videos over ten minutes long. The mechanism is not a longer video model. Higgsfield's creative agents, running on GPT-6 Astra, call external tools for 3D modeling work, which he says is what keeps characters and scenes consistent across a long piece. His evidence is the company's own YouTube channel, which he puts at almost half a million subscribers and which now produces its instructional videos this way. He also calls GPT-Image-2.5 the first model that reliably renders text and infographics on top of imagery, and says Codex lets his roughly 200 creatives prototype features that 100 engineers then ship.
Every number here is the company describing itself in a partner's marketing post, and the post does not say what a ten-minute generation costs or how long it takes. Treat the consistency claim as a hypothesis until you have run it.
For builders
If you already pay for Higgsfield or a competitor, run the consistency test yourself before promising a client a long piece: one character, three consecutive scenes, same wardrobe and lighting, and count the fixes. Price the minute before you price the project, because a ten-minute render spends credits at a very different rate than a social clip. And if text inside generated images matters to you, test your own language and your own brand font; the post makes no claim beyond English.
Story IV
Epic says it vibe-coded its new launcher, and it is faster than Steam at the thing it chose to measure
Epic released a public Preview of a new Epic Games Launcher on October 14 with the line "programming is hard. So, instead of doing that, we vibe coded a new Epic Games Launcher," per Ars Technica. Store GM Martin Keely told PC Gamer the team started from scratch in a different tech stack and used AI to write and review features, replicating the old launcher's functionality but not its code; he told IGN the approach let a small team rewrite the codebase and ship on Windows and Mac with Linux to follow. Ars's own test found the new launcher reaches the store page a few seconds faster than Steam from a cold start; Epic's other claim, a 0.06-second edge restoring from the tray, was not noticeable.
The caveats are Epic's own. The Preview "will have some bugs," is "light on features," and social and account-management features have not been ported yet, with feature parity listed as a goal. It arrives the same week CEO Tim Sweeney described "a huge pivot" moving developers around "for maximum AI acceleration," and a Bloomberg report of an AI-first model for an upcoming shooter.
For builders
This is the rewrite pattern worth copying: new stack, old behavior as the spec, AI writes and reviews, humans own what ships, and you launch as a Preview with a feedback form instead of a replacement. If you have a legacy app you are afraid to touch, write down its behaviors as a checklist first, then let the agent rebuild against that list and measure one thing users feel, like cold start. Say "preview" and "light on features" out loud; Epic did, and it is why the bugs will not be a scandal.
— The Vibe Gate news desk. We read the firehose so you can keep building.