AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor, zkao, discovered a critical soundness bug in OpenVM's guest library openvm-pairing. The bug allows a malicious prover to forge any pairing equality, breaking the soundness of Groth16, PLONK with KZG, and BLS signatures that rely on the vulnerable library. The issue was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
How It Was Found
ZK/SEC scanned OpenVM as part of an AI experiment using Opus 4.6, 4.7 and Codex 5.3, 5.4 with simple prompts and expert-maintained skills. Initial runs returned valid but non-exploitable findings. The team then deployed zkao, their specialized AI auditor, which after 9.5+ hours of scanning produced many findings. A quick triage identified the critical pairing issue with a minimal PoC generated by zkao itself.
The Bug at a Glance
| Bug | AI Severity | OpenVM Severity | Fix Commit | Found By |
|---|---|---|---|---|
| openvm-pairing pairing check missing proper subfield check on scaling factor | Critical | Critical | a720e2c | zkao |
Impact
Pairings are the engine under Groth16, PLONK with KZG, and BLS signatures. A verifier typically checks whether a product of pairings equals one. If a prover can make a false pairing product appear to be one, everything built on top is no longer sound. The bug specifically lies in the pairing check missing a proper subfield check on the scaling factor.
Note: This is not a bug in the zkVM's proving system itself—only code using the vulnerable openvm-pairing library is affected.
Technical Details
ZK/SEC's AI pipeline uses a modular architecture: subagents analyze individual code modules for assumptions and invariants, then a main agent combines findings. For complex codebases like OpenVM, isolated bug hunting is insufficient; the key is capturing cross-module invariant violations. ZK/SEC plans to publish more technical details in a follow-up post.
📖 Read the full source: HN LLM Tools
👀 See Also
llm-hasher: Local PII Detection and Tokenization for Hybrid LLM Workflows
llm-hasher is a tool that detects personally identifiable information locally using Ollama before data reaches external LLMs like OpenAI or Claude, tokenizes the PII, and restores originals after processing. It uses regex for structured data types and a local LLM for contextual detection, with encrypted storage for mappings.
Claude's Security Review Command Has Limitations for Production Systems
A developer found Claude's security review command helpful for basic validation like MIME types and file size limits, but insufficient for production hardening against sophisticated threats. The solution required a two-week architectural overhaul separating file processing into a restricted worker with limited permissions.
Windows Notepad App Remote Code Execution Vulnerability CVE-2026-20841
CVE-2026-20841 is a remote code execution vulnerability in the Windows Notepad app. Details and mitigation steps are available in the Microsoft Security Response Center update guide.
Introducing SkillFence: The New Runtime Monitor That Watches What Skills Actually Do
SkillFence offers a breakthrough in monitoring AI agent actions, addressing the need for transparency and security in AI-driven environments. Discover how this innovative tool can enhance control over autonomous processes.