AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor, zkao, discovered a critical soundness bug in OpenVM's guest library openvm-pairing. The bug allows a malicious prover to forge any pairing equality, breaking the soundness of Groth16, PLONK with KZG, and BLS signatures that rely on the vulnerable library. The issue was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
How It Was Found
ZK/SEC scanned OpenVM as part of an AI experiment using Opus 4.6, 4.7 and Codex 5.3, 5.4 with simple prompts and expert-maintained skills. Initial runs returned valid but non-exploitable findings. The team then deployed zkao, their specialized AI auditor, which after 9.5+ hours of scanning produced many findings. A quick triage identified the critical pairing issue with a minimal PoC generated by zkao itself.
The Bug at a Glance
| Bug | AI Severity | OpenVM Severity | Fix Commit | Found By |
|---|---|---|---|---|
| openvm-pairing pairing check missing proper subfield check on scaling factor | Critical | Critical | a720e2c | zkao |
Impact
Pairings are the engine under Groth16, PLONK with KZG, and BLS signatures. A verifier typically checks whether a product of pairings equals one. If a prover can make a false pairing product appear to be one, everything built on top is no longer sound. The bug specifically lies in the pairing check missing a proper subfield check on the scaling factor.
Note: This is not a bug in the zkVM's proving system itself—only code using the vulnerable openvm-pairing library is affected.
Technical Details
ZK/SEC's AI pipeline uses a modular architecture: subagents analyze individual code modules for assumptions and invariants, then a main agent combines findings. For complex codebases like OpenVM, isolated bug hunting is insufficient; the key is capturing cross-module invariant violations. ZK/SEC plans to publish more technical details in a follow-up post.
📖 Read the full source: HN LLM Tools
👀 See Also
Free Claude Skill Scans Other Skills for Security Risks
A developer has built a free Claude skill that reviews the security of other Claude skills by checking code for potentially malicious behavior and analyzing repositories with a scorecard-style approach. The tool helps answer whether a Claude skill appears reasonably safe to use.
The Human Root of Trust: Establishing Accountability for Autonomous AI Agents
The Human Root of Trust is a public domain framework addressing the lack of accountability for autonomous AI agents through cryptographic means.
ClawSecure: Security Platform for OpenClaw Ecosystem
ClawSecure is a security platform built specifically for the OpenClaw ecosystem, featuring a 3-layer audit protocol, continuous monitoring, and coverage of OWASP ASI categories. It has audited 3,000+ popular skills and is available free with no signup.
Nullgaze: Open Source AI-Supported Security Scanner Released
Nullgaze is a new open source AI-supported security scanner that detects vulnerabilities specific to AI-generated code, boasting near-zero false positives.