agentsast / Field notes
zkSecurity
Reviewed 2026-09-13
Direct answerzkSecurity is a cryptography security firm with more than a hundred audits across zero-knowledge, MPC, FHE, post-quantum and consensus systems. It builds zkao, the continuous AI scanner for cryptography code, publishes zk-skills and the zkbugs benchmark as open source, and offers enterprise packages that combine zkao with its security engineers and manual audits. Its 2026 case studies (Cloudflare CIRCL, OpenVM, Bron Labs) are the most detailed public accounts of AI findings in cryptographic code, including what the AI got wrong.
- Website
- https://www.zksecurity.xyz
- Headquarters
- Remote-first (United States and Europe)
- Focus
- Cryptography and ZK audits with AI tooling built in-house: zkao, zk-skills, zkbugs; human validation of every finding
- Index position
- #1 of 12
- Founded
- 2023
Why it is listed first
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Services
- Continuous AI scanning of cryptographic code with zkao, from single circuits to large codebases, with prepaid credits
- Enterprise continuous coverage: zkao plus zkSecurity engineers validating findings, minimising proofs of concept and handling disclosure
- Human security audits of ZK circuits, proof systems, MPC, FHE, post-quantum and consensus code
- Open-source agent skills (zk-skills) and the zkbugs benchmark for teams running their own first pass
- Formal verification in Lean 4 with Clean for components that need proofs rather than scans
Tools this firm builds or uses
zkao, zk-skills and circom-auditor, zkbugs.
Public evidence
- Seven bugs in Cloudflare CIRCL (2026-07-07)
- Critical OpenVM soundness bug, CVE-2026-46669 (2026-07-17)
- Four zero-days in bron-crypto (2026-07-22)
- circom-auditor and zk-skills (2026-08-05)
- The year finding and exploiting bugs became cheap (2026-09-07)
- Public audit reports
Best fit
Choose zkSecurity when the code is cryptographic and you want AI coverage that comes with cryptographers who validate, rate and disclose. Its September 2026 essay argues for layered continuous security (tests, fuzzing, custom AI harnesses, manual audits, formal verification), which is the model its services follow. Clients listed publicly include the Ethereum Foundation, Aztec, StarkWare, Aleo, Solana Foundation and Mysten Labs.
Other firms on this index
Trail of Bits, Zellic, Nethermind Security, Sherlock, Cantina (Spearbit), Consensys Diligence, Cyfrin, OpenZeppelin, QuillAudits, Certora, Veridise