In May 2026, the AI model Claude Opus 4.8, working with security researcher Taylor Hornby, discovered a critical under-constrained circuit bug in Zcash’s Orchard privacy pool that allowed undetectable counterfeit coins to be minted. This vulnerability was swiftly patched after temporarily halting Orchard transactions, showcasing the powerful synergy of advanced AI and human expertise in uncovering and addressing complex blockchain security flaws.
In late May 2026, an advanced AI model named Claude Opus 4.8, developed by Anthropic, discovered a critical bug in Zcash’s Orchard privacy pool that had gone unnoticed for four years. This bug was found by security researcher Taylor Hornby, who was auditing Zcash’s Orchard circuit using a custom framework powered by Opus 4.8. The discovery was significant because it revealed a vulnerability that allowed unlimited counterfeit Zcash to be minted undetectably within the Orchard pool, posing a serious threat to the privacy and integrity of transactions.
Zcash achieves privacy through zero-knowledge proofs, which allow transactions to be verified without revealing details like sender, receiver, or amount. These proofs rely on a set of mathematical constraints called circuits that enforce transaction rules, including soundness—the guarantee that only valid transactions can be proven. The bug in Orchard was due to an under-constrained circuit that failed to anchor a critical value to a real base point, allowing malicious actors to forge proofs for coins that never existed. This flaw was deep in the code and had escaped detection despite years of scrutiny.
The exploit worked by exploiting the missing constraint, enabling counterfeit coins to be created and accepted by the network without detection. Although Zcash’s overall supply cap limited the total amount of coins that could leave the pool, the vulnerability allowed unlimited counterfeit coins within the Orchard pool itself, which could then be double-spent. This posed a significant risk, but fortunately, the flaw was caught before any exploitation occurred on the mainnet.
Taylor Hornby’s approach combined his deep domain expertise with the powerful reasoning capabilities of Opus 4.8. By mapping every constraint in the Orchard circuit and testing for weaknesses, the AI-human team was able to generate a working exploit within 24 hours of the model’s release. This collaboration highlights the importance of human judgment alongside AI in cybersecurity, especially in complex fields like blockchain where understanding the entire constraint system is crucial.
Following the discovery, Zcash’s Orchard transactions were temporarily halted, and a hard fork was implemented within days to patch the vulnerability. The bug was publicly disclosed shortly after, and no signs of exploitation were found on the mainnet. This incident marks a turning point in AI-assisted security auditing, demonstrating both the power of frontier AI models to uncover deep protocol flaws and the ongoing necessity of expert human oversight to interpret and act on these findings effectively.