GoKawiilTrail of Bits used AI to build custom tools before auditing Miden zkVM
Trail of Bits reports that ahead of auditing the Miden zero-knowledge VM, its team spent six months using AI agents to build an LSP server, decompiler, static analysis engine, and a Lean formal model of the VM executor from scratch, since almost no developer tooling existed for Miden's custom assembly language. The resulting tools and formal proofs helped uncover a security flaw allowing a malicious prover to forge Falcon signatures and steal funds from Miden account holders, plus 95 machine-checked correctness proofs covering much of the Miden core library.
GoKawiil's interpretation of the reporting above, not reported fact.
This suggests AI's value in security auditing may extend well beyond automated code review, into generating bespoke tooling and formal verification infrastructure for niche or novel languages that lack existing support. Trail of Bits frames this as a shift in how auditors can approach unfamiliar, high-assurance codebases, potentially raising the bar for depth of review on emerging cryptographic systems like zero-knowledge VMs.
- Trail of Bits built custom AI-generated tooling, including a decompiler and Lean formal model, to audit Miden VM's custom assembly language.
- The effort uncovered a critical bug letting a malicious prover forge Falcon signatures and steal funds.
- 95 machine-checked correctness proofs were produced covering a large part of Miden's core library.
Source: blog.trailofbits.com — Fredrik Dahlgren, 2026-09-21
Published there as: “Security auditing in the age of (good enough) AI”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.