--- title: Auditing in the age of (good enough) AI | daily.dev description: Trail of Bits describes a six-month preparation effort before auditing the Miden zkVM, a zero-knowledge VM using a custom assembly language (MASM) with almost... canonical: https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Auditing in the age of (good enough) AI | daily.dev og:description: Trail of Bits describes a six-month preparation effort before auditing the Miden zkVM, a zero-knowledge VM using a custom assembly language (MASM) with almost... og:url: https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4 og:image: https://api.daily.dev/og/posts/rXjmRKlO4.png og:image:alt: Auditing in the age of (good enough) AI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Auditing in the age of (good enough) AI **[Trail of Bits Blog](https://daily.dev/sources/trail-of-bits)** · 11 min read · 1 upvotes · 0 comments ## Summary Trail of Bits describes a six-month preparation effort before auditing the Miden zkVM, a zero-knowledge VM using a custom assembly language (MASM) with almost no existing tooling. Using AI agents (Claude and Codex), the team built an LSP server, a decompiler, a static analysis engine, and a Lean-based formal model of the VM executor from scratch. These tools found over 400 locations needing type validation improvements and one high-severity bug: an unvalidated prover-supplied advice value in the mod_12289 procedure that could let a malicious prover forge Falcon signatures and drain Miden accounts. The Lean formal modeling work produced 95 machine-checked correctness proofs and uncovered two subtle bugs missed by unit tests. The authors argue that agentic AI tooling has changed the economics of security auditing by making exploratory tool-building projects feasible with light supervision, something not practical a couple years prior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the high-severity vulnerability found in the Miden VM's mod_12289 procedure? An underconstrained prover-supplied advice value allowed a malicious prover to forge Falcon signatures and drain Miden accounts. The mod_12289 procedure reduces a 64-bit value modulo 12289 using a quotient and remainder supplied as advice values; the quotient was validated as a proper 64-bit value but the remainder was never checked before being passed to the u32overflowing_sub instruction, letting an attacker craft an incorrect remainder. _Teams auditing zkVM code can follow similar advice-value validation findings on daily.dev._ ### How can AI agents help build custom developer tooling for a new domain-specific language with no existing tooling? Agents like Claude and Codex were used to build an LSP server, a decompiler, a static analysis engine, and command-line tools from scratch for Miden assembly (MASM), a custom stack-machine language with no prior IDE support. The decompiler alone took over 100 AI-generated commits across months, with agents alternating between development and code review roles, and its internal analysis framework was reused for static analysis passes. _Developers exploring agent-driven tooling workflows can track similar case studies on daily.dev._ ### What bugs did formal verification with Lean find in the Miden VM core library that unit tests missed? Formal modeling in Lean uncovered two subtle bugs missed by the existing unit test suite: an edge case in the 64-bit right-rotation rotr that behaved incorrectly on large inputs greater than the Goldilocks prime when the rotational shift was a multiple of 32, and an issue in the 256-bit multiplication wrapping_mul that dropped caller-owned values from the stack before returning. _Engineers weighing formal verification against unit testing can follow such findings on daily.dev._ ## Similar posts on daily.dev - [Secret agentic AI](https://daily.dev/posts/secret-agentic-ai-pmt2j5roz) · ploeh blog · 0 upvotes · 0 comments - [The Current Position of AI in Web3 Sec: AI Mirage and the High Cost of “Cheap” Security](https://daily.dev/posts/the-current-position-of-ai-in-web3-sec-ai-mirage-and-the-high-cost-of-cheap-security-u9drwpfpu) · Coins Bench · 0 upvotes · 0 comments - [A Blueprint for AI-Assisted Vulnerability Management](https://daily.dev/posts/a-blueprint-for-ai-assisted-vulnerability-management-j5th1fhxw) · Google Cloud · 1 upvotes · 0 comments - [Prediction: AI will make formal verification go mainstream — Martin Kleppmann’s blog](https://daily.dev/posts/prediction-ai-will-make-formal-verification-go-mainstream-martin-kleppmann-s-blog-j1btzfnpe) · Lobsters · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#zero-knowledge-proofs](https://daily.dev/tags/zero-knowledge-proofs) [View this post on daily.dev](https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Auditing in the age of (good enough) AI","url":"https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4"},"datePublished":"2026-10-11T12:29:37.069Z","dateModified":"2026-10-11T12:35:03.768Z","description":"Trail of Bits describes a six-month preparation effort before auditing the Miden zkVM, a zero-knowledge VM using a custom assembly language (MASM) with almost...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/001d082d40e10d571464c07217fa111c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/001d082d40e10d571464c07217fa111c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trail of Bits Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trail of Bits Blog","logo":"https://media.daily.dev/image/upload/s--TLbYx4ip--/f_auto,q_auto/v1780213255/logos/trail-of-bits?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trail-of-bits"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,zero-knowledge-proofs","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trail of Bits Blog","item":"https://daily.dev/sources/trail-of-bits"},{"@type":"ListItem","position":3,"name":"Auditing in the age of (good enough) AI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/auditing-in-the-age-of-good-enough-ai-rxjmrklo4#faq","mainEntity":[{"@type":"Question","name":"What was the high-severity vulnerability found in the Miden VM's mod_12289 procedure?","acceptedAnswer":{"@type":"Answer","text":"An underconstrained prover-supplied advice value allowed a malicious prover to forge Falcon signatures and drain Miden accounts. The mod_12289 procedure reduces a 64-bit value modulo 12289 using a quotient and remainder supplied as advice values; the quotient was validated as a proper 64-bit value but the remainder was never checked before being passed to the u32overflowing_sub instruction, letting an attacker craft an incorrect remainder. Teams auditing zkVM code can follow similar advice-value validation findings on daily.dev."}},{"@type":"Question","name":"How can AI agents help build custom developer tooling for a new domain-specific language with no existing tooling?","acceptedAnswer":{"@type":"Answer","text":"Agents like Claude and Codex were used to build an LSP server, a decompiler, a static analysis engine, and command-line tools from scratch for Miden assembly (MASM), a custom stack-machine language with no prior IDE support. The decompiler alone took over 100 AI-generated commits across months, with agents alternating between development and code review roles, and its internal analysis framework was reused for static analysis passes. Developers exploring agent-driven tooling workflows can track similar case studies on daily.dev."}},{"@type":"Question","name":"What bugs did formal verification with Lean find in the Miden VM core library that unit tests missed?","acceptedAnswer":{"@type":"Answer","text":"Formal modeling in Lean uncovered two subtle bugs missed by the existing unit test suite: an edge case in the 64-bit right-rotation rotr that behaved incorrectly on large inputs greater than the Goldilocks prime when the rotational shift was a multiple of 32, and an issue in the 256-bit multiplication wrapping_mul that dropped caller-owned values from the stack before returning. Engineers weighing formal verification against unit testing can follow such findings on daily.dev."}}]} ```