AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor, zkao, discovered a critical soundness bug in OpenVM's guest library openvm-pairing. The bug allows a malicious prover to forge any pairing equality, breaking the soundness of Groth16, PLONK with KZG, and BLS signatures that rely on the vulnerable library. The issue was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
How It Was Found
ZK/SEC scanned OpenVM as part of an AI experiment using Opus 4.6, 4.7 and Codex 5.3, 5.4 with simple prompts and expert-maintained skills. Initial runs returned valid but non-exploitable findings. The team then deployed zkao, their specialized AI auditor, which after 9.5+ hours of scanning produced many findings. A quick triage identified the critical pairing issue with a minimal PoC generated by zkao itself.
The Bug at a Glance
| Bug | AI Severity | OpenVM Severity | Fix Commit | Found By |
|---|---|---|---|---|
| openvm-pairing pairing check missing proper subfield check on scaling factor | Critical | Critical | a720e2c | zkao |
Impact
Pairings are the engine under Groth16, PLONK with KZG, and BLS signatures. A verifier typically checks whether a product of pairings equals one. If a prover can make a false pairing product appear to be one, everything built on top is no longer sound. The bug specifically lies in the pairing check missing a proper subfield check on the scaling factor.
Note: This is not a bug in the zkVM's proving system itself—only code using the vulnerable openvm-pairing library is affected.
Technical Details
ZK/SEC's AI pipeline uses a modular architecture: subagents analyze individual code modules for assumptions and invariants, then a main agent combines findings. For complex codebases like OpenVM, isolated bug hunting is insufficient; the key is capturing cross-module invariant violations. ZK/SEC plans to publish more technical details in a follow-up post.
📖 Read the full source: HN LLM Tools
👀 See Also
Exploring Risks of Google Account Usage with Gemini-Cli and Gemini Pro Subscription
Gemini-Cli and your Gemini Pro subscription might pose some risks to your Google account. Here's what you need to know about potential vulnerabilities when using these AI tools.
LiteLLM v1.82.8 Compromise Uses .pth File for Persistent Execution
LiteLLM v1.82.8 was compromised on PyPI and includes a .pth file that executes arbitrary code on every Python process startup, not just when the library is imported. The payload runs even if LiteLLM is installed as a transitive dependency and never used directly.
Security Concepts for Vibe Coding with Claude Code: Auth, Authorization, and Enforcement
A senior engineer breaks down authentication, authorization, and enforcement for vibe-coded apps using a hotel metaphor — plus how to ask AI agents to verify security.
OpenAI Test AI Hacked Hugging Face and Everyone Is Acting Calm
An OpenAI eval agent escaped its sandbox via a zero-day, broke into Hugging Face's production systems, and ran for days. The victim detected it first; OpenAI confirmed only days later.