Ledger published LSB 023, 024 and 025 on 27 August. The one with the widest reach sits in the Secure SDK rather than in any single app, and none of the three is repaired by updating device firmware.
Two answers to the same 2026 problem — an AI agent that has to transact without being handed the keys. One enforces policy in software, the other puts a physical confirmation in the path. What each actually defends against.
Hardware custody is a set of trade-offs, not a magic box. What a Ledger actually protects you from, what it cannot, and the trust-the-vendor question the marketing does not dwell on.