AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM
blog.zksecurity.xyz
July 17, 2026
13 min read
🔥🔥🔥🔥🔥
50/100
Summary
AI auditor zkao identified a critical soundness bug in OpenVM's zkVM guest library openvm-pairing, allowing a malicious prover to forge any pairing equality. This vulnerability does not affect the zkVM's proving system itself but impacts code relying on the flawed library.
Key Takeaways
- AI auditor zkao identified a critical soundness bug in OpenVM's zkVM, specifically in the openvm-pairing library, allowing malicious provers to forge pairing equality.
- The identified bug was assigned CVE-2026-46669 and was fixed in OpenVM version 1.6.0, which all partners have reportedly upgraded to.
- The AI's candidate finding was validated by humans, confirming its exploitability and understanding its impact before disclosure to the OpenVM team.
- The complexity of zkVM codebases requires advanced context engineering for AI tools, as traditional auditing methods may not effectively identify meaningful bugs.
