AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor, zkao, discovered a critical soundness bug in OpenVM's guest library openvm-pairing. The bug allows a malicious prover to forge any pairing equality, breaking the soundness of Groth16, PLONK with KZG, and BLS signatures that rely on the vulnerable library. The issue was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
How It Was Found
ZK/SEC scanned OpenVM as part of an AI experiment using Opus 4.6, 4.7 and Codex 5.3, 5.4 with simple prompts and expert-maintained skills. Initial runs returned valid but non-exploitable findings. The team then deployed zkao, their specialized AI auditor, which after 9.5+ hours of scanning produced many findings. A quick triage identified the critical pairing issue with a minimal PoC generated by zkao itself.
The Bug at a Glance
| Bug | AI Severity | OpenVM Severity | Fix Commit | Found By |
|---|---|---|---|---|
| openvm-pairing pairing check missing proper subfield check on scaling factor | Critical | Critical | a720e2c | zkao |
Impact
Pairings are the engine under Groth16, PLONK with KZG, and BLS signatures. A verifier typically checks whether a product of pairings equals one. If a prover can make a false pairing product appear to be one, everything built on top is no longer sound. The bug specifically lies in the pairing check missing a proper subfield check on the scaling factor.
Note: This is not a bug in the zkVM's proving system itself—only code using the vulnerable openvm-pairing library is affected.
Technical Details
ZK/SEC's AI pipeline uses a modular architecture: subagents analyze individual code modules for assumptions and invariants, then a main agent combines findings. For complex codebases like OpenVM, isolated bug hunting is insufficient; the key is capturing cross-module invariant violations. ZK/SEC plans to publish more technical details in a follow-up post.
📖 Read the full source: HN LLM Tools
👀 See Also
Windows Notepad App Remote Code Execution Vulnerability CVE-2026-20841
CVE-2026-20841 is a remote code execution vulnerability in the Windows Notepad app. Details and mitigation steps are available in the Microsoft Security Response Center update guide.
Snowflake Cortex Code CLI vulnerability allowed sandbox escape and malware execution
A vulnerability in Snowflake Cortex Code CLI version 1.0.25 and earlier allowed arbitrary command execution without human approval via process substitution bypass, enabling malware installation and sandbox escape through indirect prompt injection.
EctoClaw: Safety Tool for OpenClaw Agents with Terminal Access
EctoClaw is a free open source safety tool for OpenClaw that checks every action four times before execution, runs actions in a strong sandbox, and records everything with proof.
OpenClaw User Shares Strategy for Balancing Agent Autonomy and Web Security
An OpenClaw user describes their current challenge: balancing agent autonomy with security, particularly regarding web access and prompt injection risks. They propose a solution using 'low trust' and 'high trust' agent segments with a human approval gate.