Darkbloom (decentralized AI inference on Macs)-community security audit findings (github.com)

Darkbloom, a decentralized AI inference system for Macs, has come under scrutiny following a request for an independent third-party security audit to validate its privacy and security claims. The project asserts that plaintext exposure is limited to hardware-encrypted memory and utilizes advanced cryptographic techniques like NaCl Box encryption, but concerns have been raised regarding potential vulnerabilities in its attestation process and overall security architecture. A key issue documented highlights a gap where device serial numbers are not cryptographically tied to Secure Enclave keys, which presents a risk of exploitation by malicious actors. The significance of this audit request lies in the precedent set by similar infrastructure projects, which have undergone rigorous independent evaluations before launch. The Darkbloom architecture involves users installing a closed-source binary and enrolling their devices in a Mobile Device Management (MDM) profile, raising concerns about the transparency and security of the data processed through Eigen Labs' infrastructure. Transparency in technical details, such as the scope of MDM profiles and the processes for key management and data retention, is vital. The outcome of this requested audit could significantly impact user trust and the project's credibility within the AI/ML community, reinforcing the importance of third-party verification for security-critical systems.