One skipped instruction defeats a router's secure boot

From 25M instructions to one faulty skip: fault analysis of a secure boot

Researchers let an AI agent attack the boot ROM of a widely deployed ARM router SoC, which verifies its second-stage bootloader with an RSA-PSS signature and several fault-injection countermeasures. After rehosting the undocumented ROM in emulation and recording a 25-million-instruction trace, they swept instruction skips over the verification code. Exactly one skip, placed on a conditional branch, flips the verdict from reject to accept, and the caller trusts it without rechecking.