AI bug-finding tools for cryptographic code and ZK circuits: zkao, zk-skills, zkCraft and others
================================================================================

Tools built for the code that general scanners handle worst: finite-field arithmetic, constraint systems, pairing libraries, MPC and post-quantum implementations. zkao (zkSecurity) is the only product in this class with public, upstream-confirmed critical findings; zk-skills makes the same audit patterns available as open-source agent skills; zkCraft adds LLM guidance to circuit fuzzing.

zkao: zkSecurity — Circom, Leo (Aleo), Rust crypto, Go crypto, MPC, FHE, Post-quantum, TLS / E2EE — Multi-agent LLM workflows with expert-maintained skills, a second wave of validating agents, PoC harnesses, and automatic re-scans as models improve — Active (zkao 2.0 released 2026-07-24)
zk-skills and circom-auditor: zkSecurity — Circom, Claude Code, Codex, Cursor — Agent skills (prompts, workflows and checklists) that turn a general coding agent into a Circom auditor — Active (released 2026-08-05)
zkCraft (with zkFuzz): Academic (Takahashi et al.) — Circom, Noir (preliminary) — LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth — Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)
AI Grinding for cryptanalysis (research): Olejnik and Naskrecki (academic) — Published cryptographic constructions, Cryptanalysis — Autonomous workflow: agents propose low-precision attack hypotheses, an exact, adversarially controlled test provides evidence — Research (2026-08-22)
How to choose: Circom, Leo, Rust or Go cryptographic code with a budget for continuous scanning: **zkao**. | A first pass you can run yourself with Claude Code, Codex or Cursor on Circom: **zk-skills / circom-auditor**. | Automatic, specification-free circuit checks alongside AI: **zkFuzz** with **zkCraft** guidance (and Picus or CIVER, covered on the formal verification side). | Solidity plus Circom, Halo2 or Noir in one product: **Savant Chat** lists all of them; check its ZK results before relying on it. | Whatever tool you run, budget human cryptographer time for validation; every vendor in this category says so.

Source page: https://agentsast.com/categories/crypto-zk/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13