Artificial intelligence is making vulnerability discovery so cheap that security may increasingly depend on how much companies are willing to spend before attackers do.

That is the warning from Dragonfly managing partner Haseeb Qureshi after AI models reportedly rediscovered a critical weakness in Coldcard’s bitcoin wallet firmware within minutes.

“Cybersecurity is now all about spend,” Qureshi wrote on X. The key question, he said, is how much developers invest in AI-based testing compared with potential attackers.

Source: @Hosseeb on X

Coldcard disclosed an entropy flaw affecting seeds created with certain firmware versions. The bug caused some devices to rely on a deterministic software generator instead of the intended hardware source of randomness. Coinkite released emergency updates on July 31 and told affected users to create new seeds and move their funds. Installing new firmware alone does not repair an old seed.

One test reportedly found the flaw with Anthropic’s Claude Code after about eight minutes. Qureshi cautioned that the result may have been influenced by internet access, which could have exposed the model to existing information about the bug. A separate test disabled web access and used GLM 5.2. It reproduced the vulnerability in roughly 20 minutes.

Source: Medusa Onchain on X

Based on the model’s input and output costs, he estimated that the audit cost about $2. “$2 of AI hardening would’ve caught this bug. There is no excuse for this,” he remarked. Qureshi proposed a new measure called Cost of Discovery, or CoD. The metric would estimate how much it costs a frontier AI model to independently reproduce a vulnerability.

The episode may have wider consequences for the hardware wallet market.

Qureshi argued that larger vendors will have an advantage because they can spend more on automated testing, audits, and release hardening. Smaller companies may struggle to match attackers who can scan code continuously at little cost.

Startups building wallets, smart contracts or other products that protect money should run AI security reviews before every release, he recommended.

Qureshi also challenged a common assumption about open-source security. Public code can protect users from malicious developers, he said, but it does not automatically protect them from attackers.

AI can serve both sides. It lowers the price of finding vulnerabilities, but it also gives developers stronger defensive tools.

“We have no choice but to adapt,” Qureshi said.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。