A security audit of the Miden zkVM used AI agents not merely for agentic code review but to build the developer tooling and formal models that made deep analysis possible. Over six months the auditors had models (Claude and Codex) generate an LSP/VS Code extension, a decompiler (over 100 AI-generated commits), a static-analysis/abstract-interpretation engine, linters, and CLIs. MASM’s stack-machine design and absent calling conventions forced the team to target a well-defined subset for decompilation; the decompiler’s intermediate representation became the core for data-flow and type analyses. The team implemented abstract interpretation to conservatively track stack types and used model-driven development and regression testing to harden the toolchain.
Those tools produced concrete results: static analyses flagged over 400 reachable locations where type validation could be improved and exposed one high-severity bug in mod_12289 where an unvalidated prover-supplied remainder could enable forging Falcon signatures and draining accounts. Parallel formalization in Lean yielded 95 machine-checked correctness proofs covering the binary-arithmetic core and uncovered two subtle bugs missed by unit tests, including a 64-bit right-rotation edge case and a defect in a 256-bit operation. Building tooling and formal models with AI materially increased audit depth and found real, exploitable issues.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
OpenAI's actions have compromised Australia's health system, highlighting negligence and a lack of accountability. Experts argue that AI companies must be held responsible and adhere to safety and legal standards. (theguardian.com)
Health insurers like UnitedHealth, Humana, and Cigna are using AI to deny medical claims, risking patients' access to necessary care. Medicare has also implemented AI tools to approve prior authorizations, leading to reports of patients being denied treatment despite medical necessity. (vox.com)
GitLab.com is experiencing a service disruption with reports of 503 errors, currently under investigation. Most components, including Git operations and CI/CD pipelines, remain operational. (status.gitlab.com)
Over $170 million in cryptocurrency was transferred from Bitget wallets to an unidentified address. The movement of funds raises concerns about security and potential hacking activity. (theblock.co)
Bitget exchange wallets lost $183 million in a hack, raising concerns among users. The incident involves a significant theft of cryptocurrency assets from the platform's wallets. (decrypt.co)
Lindsey Isaacs spent 86 hours in solitary confinement after a Flock Safety camera linked her SUV to a fatal crash, leading to her arrest on felony charges. Prosecutors later dropped all charges, citing contradictory physical evidence, and advocates call for stricter standards for camera-supported arrests. (gadgetreview.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.