- zkSecurity built zkao, an AI audit agent designed to continuously find bugs in code until no AI-detectable ones remain.
- An audit of Cloudflare's CIRCL library found seven real bugs, including critical issues in threshold RSA and attribute-based encryption, all now fixed.
- Bugs included: float64 precision loss, DLEQ forgery, BLS missing message distinctness, DLEQ soundness break via sign collision, HPKE PSK bypass, int64 overflow in Lagrange coefficients, and CP-ABE access-control break.
- AI severity ratings often misaligned with confirmed severity, highlighting challenges in impact assessment due to unseen downstream use.