AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM (blog.zksecurity.xyz)

In a recent experiment, researchers deployed an AI auditor named zkao to analyze OpenVM's zkVM, uncovering a critical soundness bug in its library, openvm-pairing. This vulnerability permits malicious actors to forge pairing equality checks, potentially jeopardizing the integrity of multiple cryptographic protocols, including KZG openings and Groth16 SNARK verifiers. The issue, assigned CVE-2026-46669, has been addressed in OpenVM version 1.6.0, prompting users to upgrade to mitigate risks. The significance of this development lies in the intersection of AI and cryptography, showcasing how advanced AI tools can effectively identify vulnerabilities that traditional methods may overlook, especially in complex codebases. The AI's findings were validated by human experts, emphasizing the necessity of a hybrid approach combining AI's analytical power with human oversight. The study reinforces the challenges faced by AI in analyzing complex systems while demonstrating the potential for AI-enhanced security audits to enhance the reliability of blockchain technologies and smart contracts reliant on zkVM’s infrastructure.