Prem AI Launches CyberScan: Continuous AI Security Audits for Bitcoin Infrastructure

Prem AI has launched CyberScan, a continuous AI security audit harness designed to protect financial infrastructure from automated exploits. For fintech professionals, this represents a critical shift toward autonomous, sovereign code review, addressing the vulnerability gap between formal audits where human oversight often fails to detect deep-seated regressions in open-source repositories.

What was announced

Prem AI, a sovereign intelligence firm based in Switzerland, introduced CyberScan to provide engineering teams with a persistent layer of code analysis. Initially focused on Bitcoin infrastructure, the tool maps codebases, identifies potential attack paths, and delivers prioritized findings with severity ratings. Unlike standard chat-based AI models, CyberScan functions as a dedicated harness that preserves scan state during interruptions and integrates directly into developer workflows via an API and Model Context Protocol (MCP).

The product launch follows a significant security failure in the sector: a $116 million exploit of Coldcard hardware wallets in July 2026. That breach was traced back to a 2021 firmware regression that replaced hardware random number generation with a predictable software fallback—a flaw that remained undetected by human reviewers for five years. During the two weeks following the exploit, Prem AI processed over 10 billion tokens for 50 companies, identifying three critical vulnerabilities through its research.

CyberScan is currently utilized by Bitcoin infrastructure firms ArkLabs and Breez, who used early access to run the tool against production code. Alongside the harness, Prem AI released an open-weight model, DeepSeek V4 Flash 0731, optimized for end-to-end security workflows. The model weights are available on Hugging Face, allowing institutions to maintain control over their data through encrypted inference.

"Open-weight models have quietly become some of the best security reviewers in the world. Pair them with encrypted inference and they can do that work autonomously and continuously, on legacy code and new code alike, without a company ever giving up control of it. That combination is what CyberScan is built on. Bitcoin is the canary in the coal mine. It gets hit first, and the rest of financial services will follow."

Simone Giacomelli, Founder and CEO, Prem AI

The companies involved

Prem AI is a Switzerland-based company specializing in sovereign intelligence, focusing on R&D that allows organizations to deploy AI without sacrificing data privacy or control. The firm positions its technology as a defense mechanism for high-stakes financial environments where vulnerabilities are rapidly monetized by attackers.

Breez is a prominent player in the Bitcoin ecosystem, focusing on Lightning Network integration and non-custodial financial services. ArkLabs similarly operates at the forefront of Bitcoin infrastructure, providing technical solutions for the network's scaling and utility. Both companies served as beta testers for CyberScan, integrating the tool into their release cycles to ensure code integrity before shipping.

The broader ecosystem involved includes TRM Labs, a blockchain intelligence firm that provided the analysis of the Coldcard exploit, and Hugging Face, the platform hosting Prem AI’s open-weight security models. GitHub serves as a primary integration point for CyberScan, allowing findings to be formatted as native code-scanning alerts. These entities collectively represent the intersection of open-source development, decentralized finance, and advanced cybersecurity.

What this means

The launch of CyberScan signals that the "security by obscurity" or "human-only review" models are no longer sufficient for modern fintech. As attackers increasingly use AI to scan for historical regressions and deterministic flaws, defensive tools must operate at the same scale and frequency. This move puts pressure on traditional cybersecurity firms that rely on periodic, manual audits, which are proving too slow for the rapid release cycles of decentralized finance.

The industry must now grapple with whether autonomous auditing will become a regulatory requirement for firms handling significant digital assets. While Bitcoin serves as the initial proving ground, the transition of these tools into broader banking and legacy fintech infrastructure appears inevitable as the cost of human error continues to rise.