For decades, opening a branded laptop’s BIOS and finding four sad options — time, boot order, password and little else — has been one of those frustrations that the user ends up accepting as a law of nature. The good settings exist, they are in there, but the manufacturer decides you are not going to see them. This week, an enthusiast has shown that that closed door holds up less than it seemed: he asked an artificial intelligence agent for help and ended up with 55 hidden options and four new tabs in his HP laptop’s firmware.
What exactly the artificial intelligence did
The process, according to the user’s own account collected by specialized media such as Tom’s Hardware, was not a sophisticated attack or a cryptographic feat. It was classic reverse engineering methodology, only executed by a coding assistant in a matter of minutes instead of by a specialist over weeks.
The flow had five fairly recognizable steps for anyone who has tinkered with firmware: the user dumped his device’s BIOS image and handed it to the agent; the AI disassembled the routine in charge of checking the signature; it located the exact point where the verification failed and returned the corrupted image error; it wrote a Python script that patched that verifier so that it always returned “correct”; and, finally, the user flashed the modified image back onto the chip.
The result was immediate: the advanced configuration menu that HP keeps hidden on its devices appeared complete, with dozens of configuration fields that until then only existed for the manufacturer’s engineers.
Important nuance: nobody has broken RSA-2048
It is worth bringing the headline down to reality, because on social media the story circulated with embellishments. The affected verification used RSA-2048, a cryptographic standard that remains perfectly sound and that nobody has broken here. What was done was much more prosaic: instead of forging a valid signature, the code that checks the signature was modified so that it stopped checking anything. As one of the most repeated comments in the discussion pointed out, “he patched the firmware, he did not break RSA-2048”.
The distinction is not a detail for purists. It explains why the episode does not mean that the cryptography of our devices is in danger, and at the same time it points to where the real weak link of firmware security is: not in the algorithm, but in where and how the check is executed.
Why manufacturers hide those settings
The official answer is usually stability and support. Thermal management parameters, power limits, fan curves, memory control or virtualization functions can leave a device unstable — or directly unusable — if touched without judgment, and every laptop that returns to technical service costs money. The unofficial answer, the one repeated by modding forums for years, is less kind: limiting what the user can tune helps segment the range and make the high-end model still seem necessary.
The case connects with a background discussion that has gained traction this year in Europe and the United States: to what extent does the buyer of a device have the right to configure it, repair it and extend its useful life. A laptop that allows adjusting its thermal limit is a laptop that can last two more years.
The risk is real: this can leave the device unusable
None of the above should be read as an invitation to repeat it at home next weekend. The author himself warned of this: whoever is thinking of touching the firmware should first have a chip programmer — of the CH341A type, which costs a few euros — to be able to recover the original BIOS if the device stops booting. An error writing that memory does not give a blue screen: it gives a laptop that does not turn on.
There are also two practical consequences that are worth being clear about. The first is that modified firmware voids the warranty with no possible argument. The second, more uncomfortable one, is that disabling signature verification removes precisely the barrier that prevents someone else from installing unauthorized code at the deepest level of the system.
The deeper takeaway: reverse engineering has gotten cheaper
What is truly relevant about this story is not the laptop or the brand. It is that a task that required very specialized knowledge — reading assembly, understanding the structure of a UEFI image, identifying the right routine among thousands — has been completed by an enthusiast talking to an AI agent.
That has two sides. The kind one: more ability to audit, repair and understand the devices we buy, and less dependence on what the manufacturer decides to grant. The worrying one: exactly the same tools are available to those looking for flaws with other intentions, and the entry barrier to firmware analysis has just dropped several steps at once.
For manufacturers, the message is hard to dodge: protecting a configuration menu by hiding it behind a check that runs on the device itself is no longer a sustainable strategy. Either you support verification on hardware that the user cannot patch, or you assume those settings are going to end up open. Perhaps, in some cases, the most sensible way out is the simplest: stop hiding them.
