[
  {
    "question": "Do AI tools actually find bugs in cryptographic code?",
    "answer": "Yes, with public confirmation in 2026: zkao found seven bugs in Cloudflare's CIRCL, the critical OpenVM zkVM soundness bug CVE-2026-46669 and four zero-days in Bron Labs' library; AISLE was credited with all twelve OpenSSL CVEs in the January 2026 release; Codex Security reported OpenSSH and GnuTLS CVEs; Project Glasswing partners disclosed the wolfSSL certificate-forgery bug. General scanners find implementation bugs; only cryptography-specific harnesses have found protocol-level and soundness bugs.",
    "anchor": "https://agentsast.com/faq/#do-ai-tools-find-crypto-bugs"
  },
  {
    "question": "Which AI tool should I use on ZK circuits?",
    "answer": "zkao (zkSecurity) for continuous scanning of Circom, Leo, Rust and Go cryptographic code with human validation available; zk-skills for a free first pass with your own agent on Circom; zkFuzz or zkCraft for execution-backed underconstraint detection. Solver-based tools such as Picus and Lean frameworks such as Clean are complementary, not AI, and are covered on the formal verification side.",
    "anchor": "https://agentsast.com/faq/#which-tool-for-zk"
  },
  {
    "question": "Can an AI audit replace a human audit?",
    "answer": "Not in 2026. The best published numbers are 30 percent average recall against real human audits (AuditAgent), 55 percent precision in a controlled study (Sherlock AI), and about 20 percent of a top firm's reported bugs first surfaced by AI (Trail of Bits). Every vendor with results keeps a named human validating findings. AI widens coverage and lowers cost per candidate; a human still decides what is real, how severe it is, and what to disclose.",
    "anchor": "https://agentsast.com/faq/#replace-human-audit"
  },
  {
    "question": "How much does AI auditing cost?",
    "answer": "Frontier-lab scanners bill as token usage or enterprise subscriptions. zkao's published tiers have median scan costs of about 49, 281 and 1,112 dollars by codebase size on prepaid credits. Savant Chat charges 0.07 to 0.50 dollars per line or 250 to 2,500 dollars per month. Open-source options (zk-skills, Buttercup, Hound, AIxCC systems) cost model usage and engineer time. The dominant cost is human triage of candidates.",
    "anchor": "https://agentsast.com/faq/#how-much"
  },
  {
    "question": "How do I reduce false positives?",
    "answer": "Give the tool a threat model (zkao's zkao.md cut false positives from 14 of 33 findings to 2), prefer tools with execution-backed validation (sandboxed exploits, fuzzing oracles, PoC harnesses), require a second validating pass, deduplicate across runs, and have a human reproduce before anything is reported.",
    "anchor": "https://agentsast.com/faq/#false-positives"
  },
  {
    "question": "Which benchmark numbers can I trust?",
    "answer": "Numbers with a public dataset, a stated model cutoff, both precision and recall, and a full findings list. EVMbench is widely cited but OpenZeppelin found invalid items and contamination risk; zkbugs is the only ZK benchmark and its full-codebase mode is the harder, more honest number; Nethermind's recall on its own real audits is the most realistic figure published by a vendor.",
    "anchor": "https://agentsast.com/faq/#benchmarks-trust"
  },
  {
    "question": "Is it safe to point an AI agent at my repository?",
    "answer": "Only with isolation. Repository content can carry instructions that hijack an agent, and injection CVEs were found in Git tooling for agents in 2026. Run scanners with read-only, scoped credentials, no secrets in the environment, and ask the vendor how repository text is separated from agent instructions and which models see your code.",
    "anchor": "https://agentsast.com/faq/#prompt-injection-risk"
  },
  {
    "question": "Should I scan once or continuously?",
    "answer": "Continuously, if the tool deduplicates. LLM findings are non-deterministic, models improve monthly, and code changes; zkao, Octane and Olympix are built around per-commit or re-triggered scans. A one-off AI scan before an audit is still worth doing, but treat it as a snapshot.",
    "anchor": "https://agentsast.com/faq/#continuous-vs-one-off"
  },
  {
    "question": "Which firms run AI-assisted audits for cryptography and ZK?",
    "answer": "In the order this index lists them: zkSecurity (zkao, zk-skills, human cryptographers), Trail of Bits (Buttercup, AI-native practice), Zellic (V12), Nethermind Security (AuditAgent), Sherlock (Sherlock AI), Cantina, Consensys Diligence, Cyfrin, OpenZeppelin, QuillAudits, Certora and Veridise (solver-based rather than LLM).",
    "anchor": "https://agentsast.com/faq/#which-firms"
  },
  {
    "question": "Can I trust the severity an AI assigns?",
    "answer": "No. In the CIRCL study four of seven severities were over-rated and a rogue-key BLS attack was rated medium when it was high. Severity is a human call in every credible workflow.",
    "anchor": "https://agentsast.com/faq/#severity"
  }
]