Dragonfly researchers used GLM 5.2 to detect a Coldcard firmware vulnerability in 20 minutes, costing about $2 for the full run.

Test and findings

In a controlled experiment, the language model located the same firmware flaw without any human hints or guided prompts during the session.

The team reported that the short, low-cost check reproduced an exploit that previously led to user losses, demonstrating rapid reconnaissance capability.

Scale of losses and attack activity

According to Galaxy, total losses from related hacks have exceeded $130 million, and the offensive activity is reported to be ongoing across multiple campaigns.

Dragonfly’s managing partner, Hasib Qureshi, framed modern security as a competition of compute power, where budgets determine the depth and persistence of discovery.

Economics of offense and defence

Casual users may spend a couple dollars on cursory scans, while some threat actors invest between $500–$2000 per operation and run several AI agents overnight to broaden coverage.

The researchers noted that only a vendor with full firmware access and sustained compute can perform exhaustive audits at the scale required to find deeply hidden bugs.

Dragonfly explained that to counter an attacker operating with a budget of $5,000, a developer typically needs to allocate about $10,000 to find the same issues and additional problems.

Industry implications

Qureshi expects a so-called "COVID-moment" in security, when a wave of high-profile breaches will push companies to adopt AI-driven firmware audits as a standard practice.

The experiment illustrates how low-cost, high-speed AI checks can change the threat landscape and how defenders may need to scale resources to match attackers.