A 1,534-line commit called "runs"
Coldcard shipped firmware that generated wallet seeds from a weak PRNG. No AI was involved. That's the part worth sitting with.
A Coldcard is a hardware wallet. It has one job: generate a private key nobody can guess, and keep it away from the network. In firmware v4.0.0, it didn’t do the first half.
Somebody wanted to swap MicroPython’s random number generator for their own. The build came back with duplicate symbol errors. Instead of untangling the collision, they turned the other one off:
#define MICROPY_HW_ENABLE_RNG (0) // We have our own version of this code.
The error went away. So did the hardware RNG. The replacement was never actually wired up, so random.bytes(32) fell through to Yasmarang - a tiny, fast, thoroughly non-cryptographic PRNG that MicroPython keeps around for when you don’t have hardware entropy. That’s what generated seeds. Dusty Daemon’s write-up walks the whole call chain, and it’s worth reading in full.
What stuck with me wasn’t the bug. It was the commit: 1,534 lines changed, message runs. Five characters. There’s another one in there whose entire message is x.
Nobody’s AI did this
Worth saying plainly, because it would be easy to file this under vibe coding: no model wrote that line. A person did, years before any of us had an agent sitting in a terminal. Mistakes come from being rushed, from being sloppy, or from not knowing any better, and humans have had all three well covered for decades.
Which is exactly why I keep pushing back when AI gets sold as a different category of thing. It isn’t. It’s fallible in the same ways we are, just faster and with better grammar. It has no passion and no knowledge; it has statistics. And the comment in that line - “We have our own version of this code” - is the most human artifact in the whole story. Someone believed it. It wasn’t true. Nobody checked.
The bottleneck was never typing
AI has genuinely sped up how fast code appears. It has not moved the thing that actually protects you, which is somebody competent reading the code and understanding what it does on the real hardware.
A 1,534-line diff is a 1,534-line diff whether a model produced it in ninety seconds or a person produced it over a weekend. If nobody reads it, it’s a liability either way. The difference now is that the ninety-second version arrives more often, and review capacity didn’t grow to match.
So the rule I work by is boring: scale review to the stakes, not to the volume. A marketing site can ship on vibes. Something holding other people’s money or other people’s data gets a second set of eyes that actually knows the domain - not another model summarizing the diff for you, because the model shares the failure mode. It’ll tell you the change looks reasonable. It looked reasonable to the author too.
Go fast where being wrong is cheap. Slow down exactly where it isn’t. That’s most of the discipline, and it’s the same advice whether the code came from a person or a machine - which is sort of the point.
I wrote a while back that AI is the race car and I’m the driver. This is the other half of that: the car doesn’t decide which races are worth losing.