AI Can Copy Any App. 5 Checks Before You Cancel Yours

What happened

Three weeks ago I showed you AI cloning Photoshop. Since then that free clone, PhotoCraft, has passed 75,000 stars on GitHub, and an HSBC analyst downgraded Adobe’s stock, naming the free clones as part of the reason.

The short version: a tool called REA, Reverse Engineer Anything, lets AI agents take apart apps you don’t have the code for. It has passed 400,000 stars on GitHub. A developer called Brandon Thomas used Claude to build free versions of Adobe’s apps: PhotoCraft for Photoshop, FilmCraft for Premiere. Heise, the German tech site, now counts 13 apps in his projects, and Al Jazeera reported versions aimed at Word, PowerPoint and Excel.

Wells Fargo cut Adobe to underweight on October 12th, partly over how fast it can turn free users into paying ones. HSBC cut it the next day. Adobe itself made no statement about the clones, and there’s no lawsuit that I could find.

So should you cancel the app you pay for? For some of you, honestly, yes. But the developer’s slogan is “software is over”, and his own roadmap tells a very different story.

Where the control failed

As reported by heise, the Photoshop clone has over 1,700 tests. This is serious work. By the project’s own estimate it is ready for real work about 45% of the time. More than a quarter of its test files still come out different from Photoshop’s, and full parity needs another 2,300 to 4,100 agent hours. For a few weeks of work, that’s astonishing.

But as the heise commentator put it, AI has made copying cheap, not inventing. Photoshop has been around since 1990: 36 years of decisions about what happens when a file is corrupted, or when a print shop rejects your colours. A clone copies the results of those decisions. Nobody is making them for it yet.

I’m an auditor, so I don’t look at the price tag. I look at what the price is buying. The audit word is total cost of ownership: the price on the tag plus everything it costs to keep the thing running. A free clone has a zero on the tag. Its total cost of ownership is never zero.

You were never really paying for the code: you were paying for someone to answer for it.

The evidence an auditor should ask for

Five checks find out who that someone is. Each takes a few minutes.

1. Who fixes it when it breaks? With paid software, a company’s security team is on the hook to patch holes. With a clone, it depends on who maintains it. In May, a security firm called RedAccess said it found around 5,000 AI-built apps on platforms like Lovable and Replit exposing sensitive data, including a Brazilian bank’s internal finances. Axios verified some examples; the platforms said a public app isn’t automatically a breach. To be fair, a desktop app that keeps your files on your own machine can be more private than a cloud one. The test: on the clone’s GitHub page, check when it was last updated, whether there’s a security file telling you how to report a hole, and whether open issues mention crashes or lost data. Download only from that page, never a search ad: fake and cracked installers are a classic way to deliver password-stealing malware. No security policy means the security team is you.

2. Does it open your client’s files? For your holiday photos, 45% might be plenty. When a client sends a layered file at 9 at night and wants it by morning, “more than a quarter of files come out different” is a lost client. The 20-minute test: take three real files from last month, including the hardest one. Open, edit and save each in the clone, then open it in the original or send it to a colleague who has it. If even one comes back different, keep paying for now.

3. Will it still be there next year? A clone usually has one maintainer and can disappear in a day. On October 14th, Microsoft’s Mojang sent GitHub a takedown notice over a browser copy of Minecraft covering 111 repositories. Paid software can disappear too. One small business owner ran QuickBooks 2003 for 14 years; then his hard drive died, and Intuit’s activation service, he says, has been off since around 2017. So he built a free replacement, SlowBooks Pro. A clone gives you code you can keep. A subscription gives you a promise that can end. Either way, export your data this week into files anything can open (PDF, CSV, plain images) and keep a copy of any installer. Rent the software if you like, but own the data.

4. Who carries the legal risk? Both clone makers say they built from public information, never the original code: a clean-room build. Andres Guadamuz, an IP law academic at the University of Sussex, says we don’t yet know whether that claim holds up. At work it can become your company’s problem: Adobe’s terms ban reverse engineering, and on a company plan the company signed. SlowBooks’ licence lets you use it free forever but not sell it or offer it as a paid service. PhotoCraft’s licence gives it to you as is. Search the licence for “commercial” and “service”, and on a work laptop ask IT in writing: am I allowed to? Free to use isn’t free to do anything with.

5. Who answers for your customers’ data? Say your clinic swaps its paid billing software for a free AI-built one holding names and phone numbers. Under India’s Digital Personal Data Protection Act, you are the data fiduciary: whoever decides why and how personal data is used. Not the app, you. You must take reasonable security safeguards, even for processing someone else does on your behalf, and after a breach tell the Data Protection Board and every person affected. The maximum penalty for failing on safeguards is 250 crore rupees. That’s the ceiling, not a typical fine, and the rules are still being phased in, with full compliance reported for around May 2027. The free app moved the cost off the price tag and onto you. That’s what a Tally renewal is for: a TallyPrime Silver licence is ₹22,500 plus GST, the early renewal ₹4,500, and most of it pays for statutory updates when GST rules move.

The test to run this week

For every app that holds customer data, write three lines:

1. What personal data is in it?
2. Where is it stored?
3. Who do you call tonight if it leaked?

If you can’t fill in line three, you just found out what you’re paying for.

Students and hobbyists: try the clones, download from the official page, keep backups and keep anything private out of an alpha app. Freelancers: keep paying for the one tool your client’s files depend on, cancel the apps you open twice a year, and use the clones as leverage when you renew. Small businesses: pay for accountability, meaning updates that keep you legal, someone who patches security holes and a support line that picks up. Everything else is up for negotiation.