September Trail of Bits Tribune: Fact-checking 1Password's AI patching benchmark, and a signature-forgery bug in Miden's zkVM. Also: a string-slicing bug in Lean, 27 advisory submissions to OpenClaw, and seven new security reviews. mailchi.mp/trailofbits/septe…

Google tried to keep a quantum weapon secret using zero-knowledge proofs. It lasted 63 days. In March, Google Quantum AI published a new version of Shor's algorithm aimed at secp256k1, the elliptic curve that protects every Bitcoin and Ethereum wallet. It needs roughly 1,200 logical qubits, a dramatic improvement over everything before it. Then Google did something no one had done before. It didn't publish the circuit. It published a zero-knowledge proof that the circuit exists, which certifies the attack is real without revealing the attack. Then the experiment started to break. Six weeks later, @trailofbits found memory bugs in Google's Rust prover. They forged a valid proof for a circuit that claimed zero Toffoli gates, an attack that cannot exist. It passed verification with the same key as the original. Google patched it. On day 63, André Schrottenloher of Inria published his own circuits, rebuilt independently from Google's public papers. They matched Google's qubit counts and needed fewer gates. The hidden weapon was now open source, and slightly better. Google researcher Craig Gidney confirmed the match and wrote: "We should just publish openly." Zero-knowledge proofs were built to hide your balance, your identity, your vote. Here, a cryptographic tool was used to hide a weapon against cryptography, and both the hiding and the secret failed within one quarter. The lesson isn't that ZK is broken. A proof is only as honest as the code that checks it. And in mathematics, a secret doesn't stay a secret just because it's hidden: once the world knows an answer exists, someone finds it. The only thing still protecting Bitcoin from this attack isn't secrecy. It's hardware, and hardware gets better every year.

We've been taking security very seriously at OpenClaw for a while now. We just completed a Trail of Bits audit, publish our security advisories unlike every other agent product, and have alot more coming in this department! openclaw.ai/blog/openclaw-tr…

You’d expect a lockfile to make a dependency immutable. But often it doesn’t: a hacked repository can swap in malicious code for the **same package and version**, and most package managers install it anyway.

prompt: "Read the last year of Trail of Bits posts and consider implications for witchy." It's free security.

We tested 25 package managers against a simulated malicious repository. Without a lockfile, only Go and vcpkg verified every download in our tests. With a lockfile, it's fewer than half. blog.trailofbits.com/2026/10…

"Every one of these maintainers has these two wolves in them." @thebensams on @hackaday's FLOSS Weekly, on why some maintainers go all-in on AI agents and others, a lot of them in Rust, won't unless they're forced to. piped.video/watch?v=TaTxSyGM…

Hash several inputs by concatenation and the boundaries vanish: different sequences give the same SHA-256 digest. Trail of Bits' SequenceHash appends each input's length as a fixed 128-bit integer, so every sequence encodes one way. Rust, Go and Python. blog.trailofbits.com/2026/10…

Credit to Trail of Bits for showing where agents pay off before a security review even starts. For one audit they spent six months having agents build the tooling first: an LSP server, a decompiler, a static analysis engine and a Lean model of the VM. The analyses flagged 400+ places where type validation could be tightened. The Lean work produced 95 machine-checked correctness proofs. Their line: "Today, a failed side project only costs tokens." blog.trailofbits.com/2026/09…

We're excited to announce that @trailofbits, an independent security research firm, has completed a security review of Kamui's RWA infrastructure.

We’re bringing together some incredible teams across the Arbitrum ecosystem to support founders building at Founder House Singapore. > @Dune > @Paxos > @ZeroDev > @GMX_IO > @trailofbits > @pendle_fi > @Quicknode > @RobinhoodCrypto > SBI Digital Markets Innovating across tokenization, AI and programmable finance? Join us and Robinhood Chain in Singapore from October 23rd-25th. Register here: luma.com/openhouse-singapore…

@ShieldFi is a fortress. Over the past years we've done: - A Lean impl of the proof system (thx @Zcash for paving the way!) - ACL2 impl of our circuits and consensus (thx Kestrel!) - TLA+ impls for smart contract invariants (thx @trailofbits !) - An easycrypt impl for the VM

We're hiring a Solutions Architect to own the technical strategy for our key clients, stay with accounts after each engagement, and design the program that follows. Remote, US or Canada. apply.workable.com/trailofbi…

Thank you to @trailofbits for sponsoring OAIC 2026! They recently published research where they gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents. In its final escape, the agent chained three 0-days into a working exploit. blog.trailofbits.com/2026/08…

We're sponsoring @arbitrum's Open House Singapore, hosted in collaboration with Robinhood Chain, to support founders across both the online Buildathon and Founder House. From October 23-25, Founder House Singapore brings selected teams together for 3 days of product, technical, and go-to-market support to help turn early ideas into launch-ready onchain products, while competing for a share of $300K in prizes and grants. Founder House teams will get a remote mentoring session with @gintaria from our team. Apply here: luma.com/openhouse-singapore…

Hashing multiple values together is easy to get wrong, and mistakes can lead to forgeries worth millions in zero-knowledge proofs. We built SequenceHash and SequenceMAC to fix that for any hash function, not just Keccak. blog.trailofbits.com/2026/10…

Trail of Bits published notes on 18 September on reviewing the Miden zkVM. The part worth reading is what happened before the review started. Security firms — the same firm included — have published a number of posts describing how they pointed an agent harness at a codebase. This post is about a stage earlier than that: "before code review even starts, agents now allow us to build custom tooling and formal models that improve the quality and depth of our reviews." Miden has its own assembly language, MASM, and very little tooling around it. The firm had six months of lead time, because the implementation was not yet feature complete. It spent them having its agents build an LSP server, a decompiler, a static analysis engine, and a Lean model of the VM executor. None of that was the review. Applied during the review that followed, those tools produced concrete results. The static analysis identified over 400 unique locations where type validation could be improved, all of them reachable from the library's public API, as well as one high-severity finding: a remainder supplied by the prover was never validated before being passed to a 32-bit subtraction — "a malicious prover could exploit this to forge Falcon signatures and drain any Miden account controlled by a Falcon key pair." The Lean modeling effort produced 95 machine-checked correctness proofs covering all the binary arithmetic in the core library, and surfaced two more bugs the existing unit tests had not caught. The detail worth sitting with is smaller than any of those. The decompiler was the single largest piece of the work, over 100 agent-generated commits across months. The firm's own account of where the benefit landed: "The main benefit of this work turned out to be the decompiler's internal analysis frameworks and intermediate representation, which we could reuse for static analysis, rather than the full decompilation pipeline." The post is direct about why work like this did not happen before. It is "highly exploratory in nature, and the end results and potential payoff may be difficult to predict," which makes it "hard to sell clients on them in advance." What has changed, on the post's own account, is the cost of a miss: "Today, a failed side project only costs tokens." The payoff is no easier to predict than it was. What a wrong guess costs is smaller. One thing about this particular case is worth noting on its own. The main benefit ended up somewhere the single largest piece of the work had not been aimed at. That is a payoff shape easier to recognize once the work is finished than to argue for before it starts. blog.trailofbits.com/2026/09… #DeepSafe #Web3Security

In Comet and Computer, BrowseSafe screens retrieved content for prompt injection security. Tool guardrails reinforce your intent, and sensitive actions require confirmation. Trail of Bits audited these defenses. Enterprise audit logs record all agent actions.

Introducing the Arbitrum Security Program The Arbitrum Foundation is subsidizing smart contract audits for teams building on the Arbitrum Platform including: > apps on testnet > projects on mainnet > migrating from another chain > dedicated Arbitrum chains Get audited with the likes of @OpenZeppelin, @trailofbits, @cyfrin, @Nethermind and many more Read more below and register today: tally.so/r/3xzEzv?ref=blog.a…

We've reviewed AvalancheGo, libevm, and Subnet EVM for @AvaLabs. We also built Slither, Echidna, and Medusa, and published 391 blockchain security reviews. Avalanche builders can now request an audit from us through the Avalanche Audit Marketplace. build.avax.network/audits/fi…