Ledger and Trezor urged researchers to report bugs privately and give vendors time to fix them as AI makes vulnerabilities easier to find and exploit.