One developer and an AI model rebuilt the visible half of Adobe's suite in eleven days. The project's own parity documents show the other half, file fidelity, plug-ins and professional depth, getting more expensive the closer anyone looks. That half is where software protection now sits.
Between 30 September and 11 October 2026, Brandon Thomas, founder of ArtCraft, published seven open-source Rust applications built with Claude as replacements for Photoshop, Illustrator, Premiere Pro, Lightroom, After Effects, InDesign and Acrobat Pro. Coverage moved fast and repeated the founder's claim of full Photoshop parity within a month. One headline called the work reverse engineered, which he denies, and at least one outlet reported a parity figure the project itself had withdrawn.
Almost everything about this case can be checked. The repositories are public, the commit logs are timestamped, and each project publishes a parity document grading itself against the Adobe product it targets. This report reads those documents instead of the headlines, and uses them to answer a question every software company now has: if a product's behavior is visible, how long does the code behind it stay scarce? Commit, star and download counts were pulled from the GitHub API on 11 October 2026. The parity grades are the project's own and are treated as vendor claims throughout, even where they are unflattering to the project.
Closed source no longer protects the half of a product that users can see. ArtCraft copied the visible breadth of Adobe's suite in days, and its own measurements show the other half, file fidelity, plug-ins and professional depth, getting more expensive the closer anyone looks.
PhotoCraft's first commit, "init repo", is dated 30 September 2026 and adds five lines. On 10 October its parity document graded the app at about 76 percent of Photoshop's features present and about 45 percent ready for real professional work. Across the seven apps the public repositories recorded 9,390 commits in twelve calendar days, 5,449 of them carrying a Claude co-author line, and drew about 90,000 GitHub stars and roughly 3.07 million release downloads.
On Reddit Thomas wrote "We're going to reach 100% parity within a month." Two days later on Hacker News he said 99 percent would take months. His project's documents put the seven apps between 45 and 62 percent ready for real work. PhotoCraft's estimate of remaining effort went from 140 to 220 agent-hours on 3 October to 2,300 to 4,100 agent-hours for full parity on 10 October, about fifteen times larger, once 1,230 user issues landed against features already counted as done.
PhotoCraft's README says re-saving preserves 307 of 309 files in a public PSD test set. Its parity document gives 133 of 256, or 52 percent, on files authored in Photoshop itself, and records users reporting that Photoshop refuses files PhotoCraft writes. It cannot host .8BF plug-ins. FilmCraft cannot open Premiere projects, and EffectCraft cannot open After Effects projects or run their plug-ins.
Courts have protected clean-room rebuilds and uncopied menu structures for decades, from Sega v. Accolade through Lotus v. Borland to Google v. Oracle. But Section 17 of Adobe's terms defines reverse engineering to include "monitoring or tracking the inputs and outputs flowing through a system", Bowers and Davidson enforced clauses like it, and PhotoCraft's own parity document describes inspecting the installed Photoshop bundle and "strings in the main binary". Adobe also holds a content-aware fill patent and won a jury verdict on a palette patent in 2002.
No Adobe statement, takedown notice or lawsuit was found as of 11 October 2026. That same day the repository descriptions stopped naming the Adobe products they reimplement, two days after an issue titled "You are asking for lawsuits" was opened. The READMEs still name them. Silence is the rational move for Adobe: a lawsuit turns a 45 percent alpha into a cause, and its strongest claims need evidence that discovery would supply better than a press release.
PDF tools, developer frameworks and thin workflow SaaS, where the value is visible behavior over a published format, are the most exposed. Cloudflare rebuilt the Next.js API in about a week for about $1,100 in Claude tokens. Systems of record, regulated software and products built on proprietary data or a network of users are the least exposed, because a clone copies the interface and starts with none of the rest.
PhotoCraft improves by testing against real Photoshop files and bug reports. The material that most speeds a rebuild is a company's own corpus of real customer files, its regression suites, its ranked bug list and its internal specs. Those are what to stop sharing, including with AI tools on consumer plans, where training on inputs is an opt-in setting and feedback can be kept for five years.
The test is what fraction of a product's value a stranger can observe by using it. Where that fraction is high, a model can copy it. The ratings are the author's assessment from the evidence in the report, not a measurement.
A rebuild copies viewing, forms, annotation and signing. Adobe's Public Patent License covers compliant ISO 32000-1 implementations, so PdfCraft is the safest of the seven apps legally and what remains is cloud document services.
Exposure: high
A rebuild copies the full API from docs and tests. Cloudflare's vinext reported 94 percent coverage of the Next.js 16 API after one engineer's week. Hosting, support and brand are what's left.
Exposure: high
Menus, tools, filters and shortcuts copy in days. Native-format fidelity, plug-in markets, trained users, Adobe-patented features and licensed content still protect the professional tier. Light users are the exposed ones.
Exposure: medium, high for light users
ArtCraft added Word, Excel and PowerPoint clones on 7 October. OOXML has been published since 2006. Real-time collaboration, admin and compliance tooling, and enterprise contracts are what a clone does not get.
Exposure: medium
Thomas has said AutoCAD and SolidWorks are next. A rebuild copies the drawing interface. DWG fidelity, geometry kernels, certification and decades of edge cases stay with the incumbents.
Exposure: low to medium
Salesforce reports more than 9,000 AppExchange listings and 91 percent of customers using at least one. Figma reported 13 million monthly active users. Certified EHR technology is a CMS program condition. None of these can be observed into existence by a model.
Exposure: low
For founders and CTOs, assume a competent stranger with a model can reproduce your product's visible behavior in weeks, and plan as if one already has. Then list what they would still lack. If the list is short, the moat is short, and the remedy is to build things that cannot be observed: accumulated customer data, integrations other companies maintain, a file format your customers' archives depend on, certification, or a network of users. Move every developer onto commercial or enterprise AI accounts and turn off feedback sharing where the plan allows. If your product is now mostly model-written, don't rely on copyright in the code, because the US Copyright Office and Thaler v. Perlmutter both point to thin protection for output a human didn't author. Patents on methods you genuinely invented, and license terms your users accept, are the legal tools that still work against a clean-room rebuild.
For investors, discount any moat argument that rests on the effort it took to write the code. Engineering headcount, lines of code and years of development are now weak evidence of defensibility. Ask what share of the product's value a user can see and price that share as replicable within a quarter. For incumbents, the case argues against selling on clone news alone: the hard half is the part that earns professional revenue, and Adobe reported $6.76 billion for its third fiscal quarter of 2026, up 13 percent, before ArtCraft launched.
The report assigns 40 percent to a long alpha where readiness stays under 60 percent for the flagship apps, 35 percent to two or three apps passing their own beta gate for light users, 20 percent to legal friction that forces renames and feature removals, and 5 percent to PhotoCraft reaching professional parity with reliable PSD exchange and plug-in hosting. The probabilities are the least reliable content in the report. The signs are the useful part, because anyone can check them in public: readiness grades rising faster than breadth in each repository's parity document, PhotoCraft's Photoshop-authored PSD score passing 75 percent, any .8BF, OpenFX or VST3 plug-in hosting being merged, a notice naming storytold in GitHub's DMCA repository, Adobe cutting entry-plan prices, or commits falling below 300 a day for a month. The call is overturned if any ArtCraft app passes its own beta gate, with its target's native file format reliable, within half a year.
This isn't a vendor summary. Every sentence is labeled by what stands behind it: verified fact, vendor claim, third-party estimate, my assessment, hypothesis, or scenario. Sources are numbered and clickable. Forward-looking sections use scenarios with observable tripwires, not forecasts. It's the same method behind every market assessment I write.
Twenty-three pages, built from public sources with no client brief and no interviews. Read it in the browser or take the PDF.
Each report here answers a real question, directed and researched against public sources and evaluated against a stated assumption, then delivered as Word and PDF. If you're weighing a platform, sizing a category, or defending a number to a board, tell me the decision behind it and I'll tell you honestly whether a report is the right tool.
Commission an assessment