tl;dr: Running locally on a 128GB Nvidia GB10 workstation, Qwen 3.8 27B reverse-engineered a commercial app's license check in about 30 minutes using purely static analysis, recovering a deliberately obscured RSA public key and producing a working authentication bypass. Notably, it caught its own incorrect first reconstruction (a mismatched integrity hash) and self-corrected without prompting. The author argues this marks a real shift: capabilities once reserved for frontier cloud models now fit on a consumer GPU, with all the privacy and threat-model implications that entails.