zkao (zkSecurity): AI bug detection for cryptography code and ZK circuits, results, pricing and how it works
================================================================================

zkao is zkSecurity's AI-powered continuous security scanner for cryptography code: ZK circuits, MPC protocols, FHE schemes, end-to-end encryption, TLS stacks and post-quantum primitives. It connects to a GitHub repository, runs multi-agent analysis built from zkSecurity's audit patterns, validates findings with a second wave of agents and re-runs scans as models improve. Its public results in 2026 include seven confirmed bugs in Cloudflare's CIRCL library, the critical OpenVM zkVM soundness bug CVE-2026-46669, and four zero-days in Bron Labs' bron-crypto, all fixed upstream.

Maintainer: zkSecurity
Website: https://zkao.io
Category: Cryptography and ZK specialists
Targets: Circom, Leo (Aleo), Rust crypto, Go crypto, MPC, FHE, Post-quantum, TLS / E2EE
Approach: Multi-agent LLM workflows with expert-maintained skills, a second wave of validating agents, PoC harnesses, and automatic re-scans as models improve
Access: SaaS; prepaid non-expiring credits; enterprise plans with human audits
Status: Active (zkao 2.0 released 2026-07-24)
Strengths: Only AI tool with public, upstream-confirmed critical findings in cryptographic libraries and a zkVM. | Built and validated by a cryptography audit firm; skills encode real audit patterns and a threat-model file measurably reduces false positives. | Continuous model: prepaid credits, deduplicated re-scans, and an enterprise path to human audits from the same team.
Limits: Candidates, not reports: zkSecurity's own posts document mis-rated severities and triage of more than a thousand candidates as the main bottleneck. | Language coverage is cryptography-first (Circom, Leo, Rust, Go); Solidity and EVM are out of scope. | Curated sign-in and no free tier; underlying models are not disclosed on the product pages.
Firms using it: zkSecurity
Sources: https://zkao.io | https://zkao.io/how-it-works | https://zkao.io/continuous-security | https://zkao.io/pricing | https://blog.zksecurity.xyz/posts/zkao-launch/ | https://blog.zksecurity.xyz/posts/zkao-2-0/ | https://blog.zksecurity.xyz/posts/circl-bugs/ | https://blog.zksecurity.xyz/posts/openvm-bugs/ | https://blog.zksecurity.xyz/posts/bron-bugs/ | https://blog.zksecurity.xyz/posts/zkao-aleo-integration/

Source page: https://agentsast.com/tools/zkao/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13