AI-Powered Code Audit Uncovers Seven Vulnerabilities in Cloudflare's CIRCL Library

zkSecurity's AI audit pipeline scanned Cloudflare's experimental cryptography library and confirmed seven real bugs, including a complete access-control break in attribute-based encryption. All bugs are now fixed upstream.

Security researchers at zkSecurity deployed an AI audit pipeline against Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, with all now fixed upstream. The results, published Monday, offer a detailed look at where AI-driven code review excels and where it still needs a human in the loop.

The most severe finding was a one-line mistake in Cloudflare's CP-ABE (ciphertext-policy attribute-based encryption) implementation. A single AND-share misassignment meant a user holding a single attribute could decrypt messages that were supposed to require satisfying a multi-attribute policy. One child of the AND gate received the full secret instead of a partial share, breaking the core access-control guarantee.

Another notable bug involved a float64 precision loss in threshold RSA signature generation. When computing polynomial terms, the code used floating-point exponentiation for values that exceeded the 53-bit mantissa limit, silently rounding results before casting back to integers. For configurations with more than 20 players, the key shares handed out were simply wrong.

A third finding was a textbook rogue key attack in BLS aggregate signature verification. The library implemented the BASIC aggregation mode but never checked that messages in a batch were distinct, leaving the door open for an adversary to forge aggregate signatures without knowing the victim's secret key. The AI correctly identified the missing check but rated it medium severity, while Cloudflare classified it as high.

Additional bugs included a DLEQ proof forgery exploiting a prover-controlled security parameter, a subtle soundness break from a FillBytes sign collision interacting with algebraic cancellation, and a Go switch-statement trap where bitwise-OR labels silently skipped PSK validation.

The pipeline used Claude Opus 4.6 paired with custom skills for most findings, with GPT-5.3 surfacing one bug independently. The researchers noted that model roles reversed when retested weeks later, with GPT-5.4 finding more bugs while Opus 4.7 only validated them.

At the heart of the experiment is zkao, zkSecurity's continuous AI audit agent designed to keep scanning code until no bugs remain that other AI tools can find. The team has now scanned over 200 cryptographic projects and accumulated more than a thousand candidate findings, with triage capacity being the main bottleneck.

The results both validate the approach and highlight its limits: AI is genuinely useful at surfacing subtle code-level bugs, but severity assessment remains unreliable, with the agent both overrating and underrating issues depending on context. For now, humans still handle final triage.

Sources: ZK Security Blog