That "attack" is what happened with coldcard.. it wasn't an actual attack (hopefully), but it was something no AI could find until somebody actually spend the time and money to find and exploit it... It went hidden for 5 years, most of which already had AI-based bug discovery tools in the hands of consumers and researchers. And for the last 1.5 years those tools were good enough to replace developers entirely. Nobody could find it until the attacker spend a good amount of tokens to discover it. Keep in mind that number generation is the first thing every crypto auditor looks at in any project. So, pointing an LLM at it is the first step that most people did with Coldcard's code for months before the attacker actually found what was wrong.