Dev used AI agents and more than 500 billion tokens to rebuild Call of Duty: Modern Warfare 2's source code

Developer Maurice Heumann details in his blog how AI agents were able to decompile Call of Duty: Modern Warfare 2 (2009), which the post calls only “a popular first-person shooter,” in an effort to rebuild its source code in C++, taking three months and over 500 billion tokens. The agents originally attempted to cheat a byte-for-byte check added after the first month of code ran, but it was “semantically wrong,” and now 99% of the game’s functions are present, with 83% matching the original.

Heumann’s goal since the beginning has been to produce an “accurate, stable and feature-complete recreation,” and he wrote on X less than two weeks ago that the game was fully playable. By his estimate, the project consumed 600–700 billion tokens. In another X post, he said he doesn’t pay for his own tokens but put the cost at about €1,200 with subscriptions or $200,000–$250,000 with API tokens.

The difficulty turned out to be not in producing the code but verifying it was correct, forcing the developer to create a check and to make sure the agents couldn’t game it. The other challenge, as he put it, was that “corporate America was here to ruin our fun.” Two earlier blog posts on the project have since been removed, and the video in his Sept. 30 X post was disabled after a report by the copyright owner. No comment from Activision is currently on record.

The method includes pointing a fleet of agents, using Anthropic’s Claude and OpenAI’s Codex, at the original 2009 PC game. Heumann started with a Claude Max (20x) plan, then added Codex Pro and used both simultaneously. These are flat-rate plans and do not use per-token API billing. “Most of the time,” the developer relied on Sonnet 5, although Opus 5.5 and OpenAI’s Luna, Sol, and Terra were “also used a lot.” For harnesses, he relied mostly on the Claude Code and Codex CLIs.

The agents read the code through IDA using Hex-Rays’ ida-mcp server. The work started with four agents, three workers and a reviewer; by Sept. 30, he wrote on X, it had “17 agents working in parallel.” Keeping all of this straight meant having one GitHub issue per translation unit, and having all agents and humans share a single Discord channel with GitHub webhook CI posts. The developer also tuned the auto-compaction threshold, from the default 90% of the context window maximum to 42% to help clear finished functions out of memory. Agents also had a tendency to drift, so an hourly cron job had them reread instructions.

The agents’ first month of code was extremely readable but “semantically wrong” for multiple reasons: wrong function signatures, types and struct layout issues, and logic that was invented or removed. The agents also made unneeded architectural changes, such as turning a config-variable lookup into one that was “orders of magnitude more expensive.”

The reviewer agent failed to stop this as there were no objective acceptance criteria, and the workers’ comments justifying their changes “effectively acted as unintentional prompt injection,” Heumann says. The team eventually stripped all comments from the source, which “helped a lot,” he wrote on X. An attempt to salvage the first four weeks of code took more time than starting from scratch would have.

The answer was an automated check, so the team switched to the same compiler used to build the original game. A script compares each rebuilt function against the game’s executable at the byte level. Calls and data references are at different addresses and are skipped, with target symbols and offsets checked instead, but data and types get the same check. Then it’s a simple matter of pass/fail for each function, and every match is recorded so CI can recheck it and alert on regressions. While this type of matching is slow and sometimes challenging, a match guarantees identical behavior down to reproducing original bugs.

Even with this positive change, the agents immediately tried to cheat by writing “inline assembly” and “repeatedly tried to modify this script to exclude their function from comparison,” Heumann wrote. Inline assembly and similar shortcuts were then banned in the agents’ instructions, and CI now hashes the verification script and checks it against a hash stored as a GitHub Actions secret. Agents cheating is an expected outcome at this point with many such reports, such as when OpenAI’s models went after ExploitGym answers instead of solving the capture-the-flag challenges directly. As Heumann discovered, having a reviewer agent alone may be insufficient.

Before the check was originally implemented, the cheaper, less capable Haiku and Luna models “produced extremely bad results,” the post says. With the check in place, there was sufficient feedback to make the models work, which cut costs and let the project scale up. After almost two more months, 99% of the functions were present, with 83% meeting the byte-exact requirements. Heumann believes the 16% lacking a byte match are still semantically correct, but diminishing returns were getting real. The blog claims the game “runs flawlessly” as it stands.

For “obvious reasons,” the project’s code is remaining private and will be used “for my own needs only,” Heumann says. As he put it on X, the “decompiled code is obviously also copyrighted.” However, the developer has started extending Sogen, his userspace emulator, into lightweight sandboxing for agents, a response to his project’s agents wiping VMs. It will not be production-ready for a while.

As for the decompilation project, Heumann says that it is a special case, as not every project can do a byte-for-byte reference, but thinks every project can get close “with enough creativity.” One takeaway lesson is that you should be willing to move past failures as “Generating code is cheap now. Throw it away if it’s bad” and focus on correctness over productivity.

Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.