# Aztec Says an Internal AI-Assisted Review Found a Flaw That Could Make Invalid Proofs Verify

The privacy network is holding the fix for its next release, and separately cryptographers are publicly disputing whether the Poseidon hash family still meets its security target.

- Published: 2026-09-01T05:55:37.258Z
- Canonical: https://polylog.news/crypto/2026-09-01/aztec-says-an-internal-ai-assisted-review-found-a-flaw-that
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network (Alpha V5)](https://aztec.network/alpha-v5), [Ethereum Research](https://ethresear.ch/t/poseidon2b-is-secure/25865)

Aztec, the privacy-focused Ethereum layer-2 network, says core contributors found a critical vulnerability in the proving system behind its [Alpha V5 release](https://aztec.network/alpha-v5) on July 27, using internal auditing assisted by artificial intelligence. In the team's own description of the [flaw](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), an attacker may be able to construct a proof that passes verification for a transaction the network should reject. Contributors say reviewers have identified no other high-severity or critical issues in the current alpha, and that the repair is planned for the next version rather than an emergency patch.

This is the second time Aztec has run this sequence. The team disclosed a critical proving-system vulnerability in Alpha V4 earlier this year, kept the technical details private until the successor release, and [told users to withdraw funds before the V5 upgrade vote](https://thedefiant.io/news/defi/aztec-v4-withdraw-june-25-v5-upgrade-security-vulnerability) made the older bug public. That pattern is now standard practice for zero-knowledge systems, where publishing a soundness bug before the fix ships hands an attacker the ability to mint value from nothing.

A soundness failure is a different risk from a smart-contract bug. When a rollup's proof can be forged, re-execution by honest validators does not catch it, because the network was designed to trust the proof instead of repeating the work. The affected component sits below every application built on top of it.

The cryptography one layer down is also under active dispute. On Ethereum Research, a post titled ["Poseidon2b is secure!"](https://ethresear.ch/t/poseidon2b-is-secure/25865) answers an earlier claim that Poseidon is not safe for Ethereum, arguing that no hash family can be judged secure or insecure without fixing the field, width, capacity, round schedule, matrices and attack model. The pressure is real: researchers at ETH Zurich published round-skipping algebraic attacks that cut Gröbner-basis preimage estimates for some Poseidon2 instances below the 2^128 level that designers target, and the Ethereum Foundation has [signalled a preference for the long-studied SHA and BLAKE3 families](https://www.zkm.io/blog/why-ethereum-walked-away-from-poseidon) for protocol use.

Both developments reflect the same underlying condition. Trust in zero-knowledge systems now rests on a small number of proving stacks and arithmetization-friendly hash functions, reviewed by a small number of specialists, and increasingly by automated tools.

## What this means

Rollup users are exposed to a risk their own diligence cannot inspect, because a proof-system soundness defect makes an invalid state transition look valid to every honest verifier. Teams that hold disclosure until an upgrade ships protect users against opportunistic attackers and simultaneously ask them to hold funds inside a system whose known defect has not been fixed. If AI-assisted review keeps surfacing this class at the current rate, the practical consequences are proof-system diversity, escape hatches and longer withdrawal delays, all of which raise the cost of running a rollup and narrow the fee advantage rollups hold over layer-1 execution.

## What to watch

- Whether Aztec ships the V6 fix on its stated timetable and publishes the technical detail, since a delay leaves a known soundness defect live on a network holding user funds.
- Whether the Ethereum Foundation formally settles on SHA or BLAKE3 for protocol hashing, which would end an eight-year research program and force zero-knowledge teams to rebuild circuits around a slower but better-studied primitive.
- Whether other zero-knowledge rollups disclose soundness bugs found by automated review, which would confirm that AI-assisted auditing, not attacker research, is now the main source of these findings.