Seven apps in eight days
On September 30, Brandon Thomas, a software engineer with fifteen years in the industry, opened a GitHub repository for an image editor he called PhotoCraft. He described it as a clean-room reimplementation of Adobe (NASDAQ: ADBE) Photoshop, written from scratch in Rust with help from an AI coding model. Within days his studio, ArtCraft, had published six siblings aimed at Illustrator, Premiere, Lightroom, After Effects, InDesign and Acrobat Pro. Developers gave the seven repositories more than 57,000 stars in nine days.
PhotoCraft is not ready for a production studio. Its own maintainers call it early alpha. As of October 13, its issue tracker lists 931 open problems, up from 447 a few days earlier, including crashes on large layered files, and Content-Aware Fill, one of Photoshop’s most-used tools, is missing. A professional designer would be foolish to switch this quarter.
The designer is the wrong customer to watch, though. Adobe’s U.S. terms charge a customer who cancels an annual plan, billed monthly, after the first 14 days a fee equal to half the remaining contract. When the subscription ends, access to most Creative Cloud applications ends with it. A studio that bills clients for every hour in Photoshop will accept that bargain. A marketing coordinator who crops a dozen images a month has been accepting it for lack of an alternative. A free application that opens the same files, with the menus where she expects them, changes her decision long before it changes the studio’s.
That is the shift worth a board’s attention. For most of the software era, a customer who wanted a tool accepted someone else’s idea of how the work should be done, paid for five hundred features to use five, and renewed because leaving cost more than staying. AI coding agents are lowering the cost of leaving. The incumbent’s product can remain better while its price becomes harder to defend.
The power of AI x open-source software
ArtCraft rebuilt Adobe’s products from public file specifications and observed behavior. A different project, released this summer, attacks the harder case: software whose workings are not documented at all.
It is called REA, short for Reverse Engineer Anything, and it is a free, MIT-licensed tool published on GitHub. Reverse engineering itself is old. Security researchers have spent decades using programs such as Ghidra, released by the U.S. National Security Agency, and the commercial disassemblers IDA and Hopper to take compiled software apart and work out what it does. Those tools demand scarce expertise and patience. REA removes much of that barrier. It connects a coding agent, such as Claude Code, Cursor or Codex, to the established analysis tools, installs and manages them, and records the evidence the agent gathers as it works. The analysis runs on the user’s own machine.
The project’s pitch is blunt: see a feature you like in someone else’s application, have the agent work out how it functions, then build your own version. In practice, the demonstrations so far reconstruct individual behaviors, such as a single mechanic inside an old game, checked against the original program’s outputs. That is real progress, and a long way from rebuilding a commercial suite. REA does not recover original source code, and it cannot see inside a vendor’s cloud servers.
ArtCraft and REA are just two, unrelated projects that are starting the trend of personalized, disposable software. Read together, they show the same trend from two directions. One makes it cheap to rebuild what is publicly understood. The other makes it cheaper to understand what was never published. Both reduce what an incumbent can charge for the difficulty of building a substitute.
What the clones prove, and what they don't
The loudest reaction online has been that software intellectual property is finished. The law says otherwise. The U.S. Copyright Office protects expression, not the functional parts of a program such as its algorithms, logic and system design. Anti-circumvention rules still apply, the interoperability exception in the same statute has narrow conditions, and Adobe holds thousands of patents whose reach over these projects nobody has tested. ArtCraft’s clean-room claim is its own declaration, and critics note that a single developer working with a model trained on vast amounts of public code is not the two-team process the term traditionally describes.
The legal question matters less to a board than the commercial one. A challenger does not need to win in court or match the whole product. It needs to perform the five tasks a particular customer uses and ignore the other four hundred ninety-five. That is a much smaller engineering problem, and AI has made it smaller still.
Enterprise replacement remains hard. A copied interface will not restore operations after an outage. Inspecting a desktop application will not expose a vendor’s cloud backend. File compatibility that works in a demonstration can fail on an archive accumulated over a decade. Management will cite all of this as the company’s defense, and for its largest customers management will be right. The exposure sits with the customers who never needed those capabilities and paid for them anyway.
Where the revenue actually leaks
Software companies rarely die from a clone. They erode through four quieter decisions: the customer replaces the product, buys fewer seats, demands a bigger discount, or keeps the product and sends new work somewhere else. Each is harder to see in board reporting than the one before it.
The fourth deserves the most attention because it is the hardest to see. An enterprise can keep its customer database, its service desk or its project platform exactly where it is while buying another provider’s agent to analyze the data and do the work. The incumbent keeps the installation and loses influence over the next budget. Logo retention stays at 100 percent while expansion revenue stalls.
We have seen a version of this before. Google Workspace did not beat Microsoft (NASDAQ: MSFT) Office by matching its features. It changed the terms of competition by making the browser and shared editing central to the work. Microsoft adopted cloud collaboration and kept its franchise, but on new terms. AI-built software is likely to follow the same pattern, with one addition: the challenger can now be the customer itself. A department can commission a narrow application instead of buying a general one. Each decision is small. Thousands of them can remove the expansion that the company’s valuation assumes.
The signal will also be noisy. Budget pressure and poor execution look a lot like AI substitution in a churn report. Directors should ask management to show which explanation the evidence supports, by product and by customer cohort, before accepting either story.
Three tiers of exposure
The exposure is broad enough to deserve every software board’s attention and uneven enough to make “software is dead” a poor basis for investment. The useful question is which revenue lines are exposed, not which companies.
Adobe sits in the first tier only for part of its base. Its professional customers stay for compatibility and production depth. Its occasional customers may not, and generative tools can skip the editor entirely when the buyer only wants a finished image. Both can be true while the business earns less than investors expected.
The incumbents are not standing still. Asana’s AI Studio and monday.com’s agent support try to keep automation on their own platforms. Wix bought the AI app builder Base44 in June 2025. Salesforce now prices Agentforce by consumption alongside per-user plans, and HubSpot announced outcome-based pricing for its agents in April 2026. ServiceNow’s AI Workflow Factory and Workday’s Agent System of Record aim to capture the new work directly.
DocuSign is a useful check on the alarm. Its Intelligent Agreement Management product reached 15.1 percent of ARR as of July 31, 2026, up from 12.6 percent three months earlier, and quarterly revenue grew 9 percent to $875.7 million. That is a business still growing, not one damaged by clones. The question for its board, and for every board in this table, is whether the new activity carries margins as good as the seats it replaces. A chart of rising AI usage cannot answer that.
None of this is a stock recommendation. Valuation determines how much risk an investor is being paid to take.
Private equity has less room for error
Public shareholders absorb a lower multiple. Leveraged owners absorb it twice. Take an illustrative software acquisition with $100 million of revenue and $40 million of EBITDA, bought at 15 times EBITDA with $240 million of net debt at 8 percent. Then assume a modest erosion: revenue falls 10 percent, EBITDA drops to $30 million, and the market multiple compresses to 10 times.
The company is still profitable. The equity is down 83 percent, because the debt did not shrink with the business. Net leverage rises from 6 to 8 times EBITDA, and interest cover falls from 2.1 to 1.6 times. Taxes, capital spending, working capital and principal payments reduce the cash available for debt service further, and covenant definitions need their own calculation. These are stress assumptions, not a forecast for any specific deal. The owners of Smartsheet, which Blackstone and Vista took private in January 2025, and of dozens of similar assets, have reason to rerun their underwriting rather than reason to panic.
AI cuts development and support costs, which tempts owners to protect EBITDA by cutting engineering. That can remove the reasons customers keep paying. Cheap code does not guarantee strong cash conversion once inference costs, adaptation spending and pricing concessions are counted. If expectations change, goodwill impairments and refinancing terms will reveal how far the acquisition case has drifted.
The buyer inherits the maintenance
The same change looks different from the buyer’s side of the table. A finance team comparing acquisition scenarios can commission a model built on its own assumptions, formatted the way its investment committee reads, and retire it when the deal closes. A retailer can build a tool for one seasonal campaign. An application with six users and a six-week life would never justify a software startup. It can now justify an afternoon of an agent’s time. Smaller businesses stand to gain the most: they stop paying for features they never use, and they can run some tools locally and keep control of their data.
The savings come with a job attached. Someone has to check the model’s arithmetic, control access to its inputs and fix it when a dependency changes. A wrong assumption can sit behind a polished interface and contaminate every result. When three teams each build their own definition of revenue into their own tools, customization turns into a reconciliation problem. An abandoned open-source project can leave a company holding vulnerabilities it cannot patch. And the dependence on a vendor does not disappear. It moves to the agent platform that builds and repairs the tools.
Retirement brings its own obligation. A financial commitment or a hiring decision made with a disposable tool may need to be explained months later, to an auditor or a regulator. Deleting the tool cannot mean deleting the inputs, the version and the record of how it was used.
This is how governance debt accumulates: deployment runs ahead of ownership, validation and controls. The procurement saving belongs in a fuller calculation that includes the cost of maintaining and eventually retiring what the company builds. The appeal is strongest where the task is bounded and a mistake is easy to spot and reverse. As the consequences rise, the case for paying a vendor to carry that responsibility gets stronger again.
A moat has to survive a cheap competitor
When any capable rival can build features quickly, feature depth stops being a moat. What remains defensible is narrower and easier to test. Data counts when it is differentiated, usable and backed by the rights to use it; storing a customer’s records does not qualify. A network effect exists when each new participant makes the product more valuable to the others; a share button does not qualify. Embedded workflows protect a business because replacing them disrupts operations. Reliability earns a premium where failure is expensive.
Each of those claims should show up in the accounts: pricing power that holds at renewal, efficient acquisition of new customers, and profitable expansion. An installed base helps, but its history cannot prove the next cohort will buy. The same discipline applies to the agent layer. Opening a platform to outside agents through an MCP server can create paid activity, or it can let someone else extract the context and move the work. Moving up the stack confers no permanent protection.
One question sorts the problem for any software board: if a competent team with a coding agent rebuilt the five features our median customer uses, what would that customer still pay us for, and how much? A moat that depends on the difficulty of building a rival deserves a lower multiple than one grounded in reliable operations or information customers cannot get elsewhere.
The software industry has sold customers the promise of doing more with less for four decades. Customers can now apply that promise to their software bill. Before the next board meeting, ask management for one page: the revenue from customers who use fewer than ten percent of the product’s features, and what those customers paid at their last renewal. That number shows how much of the business rests on the cost of switching rather than the value delivered.
