Auditing in the age of (good enough) AI
Summary: Trail of Bits spent six months before a Miden VM audit having AI agents build an LSP server, a decompiler, a static analysis engine, and a Lean model of the VM executor from scratch, since the zero-knowledge VM's custom MASM assembly language had almost no developer tooling. The work produced 95 machine-checked correctness proofs, over 400 locations where type validation could be improved, and a high-severity finding in mod_12289 where an unvalidated prover-supplied remainder could let a malicious prover forge Falcon signatures and drain Miden accounts.
Why it matters: A single underconstrained advice value in a modulo routine was enough to let a malicious prover forge Falcon signatures and drain any Miden account controlled by a Falcon key pair - the kind of bug that unit tests missed and that the Lean proofs caught in rotr and wrapping_mul.
Read the original at Trail of Bits Blog ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026