AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor, zkao, discovered a critical soundness bug in OpenVM's guest library openvm-pairing. The bug allows a malicious prover to forge any pairing equality, breaking the soundness of Groth16, PLONK with KZG, and BLS signatures that rely on the vulnerable library. The issue was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
How It Was Found
ZK/SEC scanned OpenVM as part of an AI experiment using Opus 4.6, 4.7 and Codex 5.3, 5.4 with simple prompts and expert-maintained skills. Initial runs returned valid but non-exploitable findings. The team then deployed zkao, their specialized AI auditor, which after 9.5+ hours of scanning produced many findings. A quick triage identified the critical pairing issue with a minimal PoC generated by zkao itself.
The Bug at a Glance
| Bug | AI Severity | OpenVM Severity | Fix Commit | Found By |
|---|---|---|---|---|
| openvm-pairing pairing check missing proper subfield check on scaling factor | Critical | Critical | a720e2c | zkao |
Impact
Pairings are the engine under Groth16, PLONK with KZG, and BLS signatures. A verifier typically checks whether a product of pairings equals one. If a prover can make a false pairing product appear to be one, everything built on top is no longer sound. The bug specifically lies in the pairing check missing a proper subfield check on the scaling factor.
Note: This is not a bug in the zkVM's proving system itself—only code using the vulnerable openvm-pairing library is affected.
Technical Details
ZK/SEC's AI pipeline uses a modular architecture: subagents analyze individual code modules for assumptions and invariants, then a main agent combines findings. For complex codebases like OpenVM, isolated bug hunting is insufficient; the key is capturing cross-module invariant violations. ZK/SEC plans to publish more technical details in a follow-up post.
📖 Read the full source: HN LLM Tools
👀 See Also
Unsecured Paperclip Instances Exposing Live Dashboards via Google Search
A Reddit user discovered a live Paperclip dashboard with full organizational data indexed by Google after searching for an error. The instance was publicly exposed without authentication, revealing org charts, agent conversations, task assignments, and business plans.
arifOS: A $15 MCP Governance Kernel for OpenClaw Tool Security
arifOS is a lightweight MCP server that intercepts OpenClaw tool calls, scores them 000-999, and blocks unsafe actions with 13 hard security floors before they reach filesystems, APIs, or databases.
Google Reports AI-Powered Hacking Reached Industrial Scale in 3 Months
Google's threat intelligence group found criminal and state groups are using commercial AI models (Gemini, Claude, OpenAI) to refine and scale attacks. A group nearly leveraged a zero-day for mass exploitation, and others are experimenting with the unguarded OpenClaw agent.
Mass NPM & PyPI Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages
A coordinated attack compromised 170+ npm packages and 2 PyPI packages, targeting TanStack (42 packages), Mistral AI SDKs, UiPath, OpenSearch, and Guardrails AI. Malicious versions execute a dropper that exfiltrates credentials and probes cloud metadata.