Security auditing in the age of (good enough) AI (blog.trailofbits.com)

A security firm has showcased a novel approach to code auditing by leveraging AI to develop custom tools that enhance the security review process of the Miden VM, a new zero-knowledge virtual machine. Over six months, the team utilized AI agents to build a Language Server Protocol (LSP) server, a decompiler, and a static analysis engine, significantly improving their capability to identify vulnerabilities. The AI-powered audit uncovered critical security issues, such as a flaw that allowed malicious users to forge signatures and potentially steal funds, highlighting the effectiveness of AI in creating robust coding environments. This initiative is significant for the AI/ML community as it demonstrates how AI can streamline complex code reviews, especially in domains lacking conventional development tools. The work resulted in 95 machine-checked correctness proofs, enhancing the assurance of the Miden library and enabling efficient, high-quality security audits. The development of these tools indicates a shift in the economics of exploratory projects, as AI's capability reduces the risk of investing in advanced tool creation, transforming the landscape of software security and code quality assurance.