AI Auditor Finds Critical Crypto Bug Humans Missed for Months
What happened
Security firm zkSecurity pointed its AI auditing tool 'zkao' at OpenVM's zkVM and found a critical soundness bug in the openvm-pairing guest library. The flaw let a malicious prover forge pairing equality checks — essentially fake cryptographic proofs that should be mathematically impossible to fake. It was assigned CVE-2026-46669 and patched in OpenVM 1.6.0.
Why this matters
Zero-knowledge proofs are supposed to be unforgeable by definition — that's the entire pitch. A bug that lets you forge pairing equalities undermines the core trust assumption of any system built on top of it. This is also a rare public case of AI tooling outperforming generic LLM audits on a genuinely complex codebase, not just linting for typos.
The slightly cynical read
'AI found a critical bug' makes for a great headline, but the fine print says humans still did the validation, exploit-confirmation, and disclosure — the AI produced a candidate, not a verdict. Convenient framing for a security startup trying to sell AI-augmented audits as the future.
What to watch next
Watch whether other zkVM projects proactively commission similar AI-assisted audits before their own CVEs get discovered the hard way — in production, by someone less friendly than zkSecurity.