Security auditing in the age of (good enough) AI
3 hours ago
- Security firms use AI agents not only for code review but to build custom tooling and formal models that improve review depth.
- For auditing the Miden zkVM, agents built an LSP server, decompiler, static analysis engine, and a Lean model of the VM executor from scratch.
- The static analysis identified over 400 locations needing type validation and a high-severity bug enabling Falcon signature forgery.
- AI-generated Lean proofs produced 95 machine-checked correctness theorems, uncovering two subtle bugs missed by unit tests.
- These preparatory side projects became economically feasible due to AI cost improvements, enabling deeper audits without upfront client commitment.