# Aztec says an AI audit found a proof-forgery flaw in its Alpha V5 network and it cannot tell whether anyone used it

The fix waits for the V6 release, and V5 is the second consecutive Aztec alpha to carry a critical vulnerability, while the network's privacy design means past chain data cannot show whether forged proofs were accepted.

- Published: 2026-10-18T05:40:05.953Z
- Canonical: https://polylog.news/crypto/2026-10-18/aztec-says-an-ai-audit-found-a-proof-forgery-flaw-in-its-alp
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network (V5 vulnerability)](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network (Alpha V5)](https://aztec.network/alpha-v5), [Aztec Network (Post-Quantum)](https://aztec.network/blog/post-quantum-aztec), [Aztec Network (V4 vulnerability)](https://aztec.network/blog/critical-vulnerability-in-alpha-v4), [The Defiant](https://thedefiant.io/news/defi/aztec-v4-withdraw-june-25-v5-upgrade-security-vulnerability)

Core contributors to Aztec, the Ethereum privacy layer-2 (L2) network, say they found a critical vulnerability in the proving system of the [Alpha V5 network](https://aztec.network/alpha-v5) on 27 July 2026, using internal AI-assisted auditing. According to [Aztec's disclosure](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), an attacker could build a proof that passes verification for a transaction the network should reject. If the network accepted it, that transaction could change state outside the rules V5 is meant to enforce.

The contributors say they cannot determine whether anyone exploited the flaw before they found it. The system does not record enough information to tell an ordinary transaction from one accepted through the faulty proving path, so past chain activity cannot show whether exploitation happened or how large it was. Aztec tells users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until incident response is complete. Contributors are working with operators, application teams and bridge operators while applications add security guards around the affected flows. The fix will ship in V6, which includes circuit updates that stop the network from accepting proofs tied to the affected proving system. Reviewers say they have found no other high or critical V5 issues so far.

The pattern repeats. Aztec disclosed a [critical vulnerability in Alpha V4](https://aztec.network/blog/critical-vulnerability-in-alpha-v4) earlier this year and told V4 users to withdraw before June 25, [The Defiant reported](https://thedefiant.io/news/defi/aztec-v4-withdraw-june-25-v5-upgrade-security-vulnerability). Aztec also says its AI audit harness has found critical bugs that months of human internal and external audits missed. Those fixes are part of the coming V6 release. At the same time, the team is planning further ahead and has published a [post-quantum roadmap](https://aztec.network/blog/post-quantum-aztec) for the network.

The design is the reason this class of bug is so serious for Aztec. Private functions run on users' own devices, and the network sees only the proof that they ran correctly. No validator re-executes the private logic, so proof soundness is the only check. The usual rollup fallback of re-running transactions to catch errors does not exist for that part of the system.

## What this means

Aztec's case shows the specific risk of private execution. In a public rollup, people re-executing transactions can in principle catch a broken prover. In a privacy rollup, a soundness bug can create assets or state that nobody can later trace. The people exposed are the applications and bridge operators building on Aztec's alpha networks, and more broadly every zero-knowledge rollup that relies on a single proving system. What is new is that AI-assisted audits now find these flaws faster than human audits did, and attackers have access to the same tools. The consensus treats each alpha-network bug as a normal part of testing a new system. The desk's view is that two critical proving bugs in consecutive releases will push Aztec and its peers, within months, toward multiple proving systems, exit mechanisms that work without the prover, and deposit caps, before institutional privacy money arrives at meaningful scale. This read would be wrong if V6 ships and runs through several months of adversarial testing and bounty programs without another critical soundness finding.

## What to watch

- The V6 release date and whether it adds a second, independent proof check or deposit limits, which would show how Aztec now prices soundness risk.
- Any bridge operator reporting unexplained supply discrepancies on V5, which would be the first evidence that the flaw was used.
- Whether other zero-knowledge rollup teams disclose findings from AI-assisted audits of their own provers, which would show the problem is not specific to Aztec.