There you have it! An AI just found a critical bug that humans missed for four years.
June 5, 2026 · 0 likes · 0 comments
Cybersecurity Workforce AI
There you have it! An AI just found a critical bug that humans missed for four years.
Researcher Taylor Hornby pointed Claude Opus 4.8 at Zcash, paired with a custom AI auditing framework he built. It found a soundness flaw in the Orchard shielded pool, the kind that lets someone mint counterfeit ZEC out of thin air with no cap and no trace.
And it had been sitting there since May 2022, inside a privacy coin whose entire reason to exist is cryptographic guarantees. The code had been audited, reviewed, and trusted with real money the whole time.
The worst part is that because of the privacy design, nobody can ever prove whether it was exploited. You can't audit what you can't see.
The Zcash team moved fast once they knew, shipping an emergency hard fork called NU6.2 and adding a turnstile to cap the supply before more damage could be done. Credit where it's due, that was a quick response.
But read the timeline again. Human cryptographers and professional auditors had years of eyes on that code and missed it. One researcher with an AI model found it in a fraction of the time.
This is the part most people aren't ready for. Everyone assumed AI would come for the repetitive junior work first, the stuff nobody fights to keep. Instead it's coming straight for the hard problems we swore required a decade of human expertise, the security auditing and cryptography we told ourselves couldn't be automated.
The market noticed too. ZEC fell from around $600 to roughly $314, losing nearly half its value in the time it takes to read a disclosure.
I spent years watching organizations treat security review as a human bottleneck nobody could replace. That bottleneck just got automated, and if AI can find a four-year-old counterfeiting flaw the experts missed, you have to wonder what's still hiding in code we already called secure.
I write about exactly this in REPLACEMENT, out July 28. The jobs we swore were too complex to automate are the ones going first.
Time to wake up!
Researcher Taylor Hornby pointed Claude Opus 4.8 at Zcash, paired with a custom AI auditing framework he built. It found a soundness flaw in the Orchard shielded pool, the kind that lets someone mint counterfeit ZEC out of thin air with no cap and no trace.
And it had been sitting there since May 2022, inside a privacy coin whose entire reason to exist is cryptographic guarantees. The code had been audited, reviewed, and trusted with real money the whole time.
The worst part is that because of the privacy design, nobody can ever prove whether it was exploited. You can't audit what you can't see.
The Zcash team moved fast once they knew, shipping an emergency hard fork called NU6.2 and adding a turnstile to cap the supply before more damage could be done. Credit where it's due, that was a quick response.
But read the timeline again. Human cryptographers and professional auditors had years of eyes on that code and missed it. One researcher with an AI model found it in a fraction of the time.
This is the part most people aren't ready for. Everyone assumed AI would come for the repetitive junior work first, the stuff nobody fights to keep. Instead it's coming straight for the hard problems we swore required a decade of human expertise, the security auditing and cryptography we told ourselves couldn't be automated.
The market noticed too. ZEC fell from around $600 to roughly $314, losing nearly half its value in the time it takes to read a disclosure.
I spent years watching organizations treat security review as a human bottleneck nobody could replace. That bottleneck just got automated, and if AI can find a four-year-old counterfeiting flaw the experts missed, you have to wonder what's still hiding in code we already called secure.
I write about exactly this in REPLACEMENT, out July 28. The jobs we swore were too complex to automate are the ones going first.
Time to wake up!