Everyone framing the Zcash Orchard bug as an AI win. A model finds in a day what world-class cryptographers missed for four years. Great headline.
But that's the less interesting half of the story. The part actually worth talking about is formal verification, and the fact that barely anyone uses it.
We already have tools built to catch this exact class of bug. Picus, Ecne, QED2, Coda. And under-constrained circuits aren't some new exotic threat, they've already turned up in Tornado Cash and Aztec. The field knows this failure mode well.
So why did none of them catch Orchard? The answer is kind of boring. Most of those tools were built for R1CS and Circom. Taking a real production Halo2 circuit and turning it into something a solver can actually chew through at scale is still half-built. Veridise hit the same wall extracting SP1 circuits: production zk systems are still ahead of what these solvers can ingest at scale. So it was never about whether the math works. It was cost and coverage. Nobody had pointed the heavy machinery at that circuit.
That's the part AI changes, and it has nothing to do with "AI finds bugs."
Two things. First, it tells you where to look. Hornby model didn't prove anything. It narrowed down which gadget to stare at, inside a circuit way too big to formalize by hand. It's basically a targeting system for methods that are otherwise too expensive to point at everything. Second, the proofs themselves. Writing a spec and closing the proof has always been months of PhD-level grind, which is exactly why so few teams bother. The Lean 4 and LLM work coming out now is starting to pull that from months toward weeks. That's the real shift.
And the actual guarantee still comes from the prover, not the model. The model's a guessing machine. Prompt it right, it finds the bug. Prompt it wrong, it walks straight past it. The formal verifier is the only piece that checks every possible adversarial input with no exceptions.
So the way I see it: AI is what finally makes formal verification cheap enough to be worth doing. And the proof is what turns an AI finding into something you can stand behind, instead of one more result you're just trusting.
This matters most where you can't see the damage. An audit can only ever tell you nobody's found a problem yet. It can't promise there isn't one. A proof can. And when a bug leaves zero trace on-chain, that gap is the whole game.
Certora already moving on this, wiring formal verification into the AI codegen loop. Zcash is going to formally verify its own circuits.
So this isn't some hunch about where security's heading, it's already underway. The gap is everyone else, the thousands of teams that'll never get a custom Zcash-style verification project.
That's the gap we're building QuillShield to close: an AI auditing agent that puts formal verification right inside the loop, so proof-backed assurance stops being a luxury reserved for teams that can fund a bespoke engagement. The bug is the easy part. Making the proof something every serious protocol can actually reach is the thing worth building.