Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Corban Villa, Sohee Kim, Austin Chu, Alon Shakevsky, Raluca Ada Popa
• Venue: arXiv: cs.CR
• Published: 2026-06-25
• Collected: 2026-06-26
• URL: http://arxiv.org/abs/2606.26933v1
• PDF: https://arxiv.org/pdf/2606.26933v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers have developed Chai, an AI-based system that discovers and validates cryptographic misuse vulnerabilities through naturally occurring signals. Instead of auditing one codebase for many flaws, Chai catalogs flaws at the library level and propagates them across a cryptographic dependency graph, delivering efficiency gains. The researchers tested Chai on X.509, JWT, and SAML libraries and discovered over 100 vulnerabilities.

What the Document Says

• Researchers have developed an AI-based system called Chai for discovering cryptographic misuse vulnerabilities.
• Chai leverages AI to detect real security issues in libraries and repurpose discrepancies as leads for tangible vulnerabilities in downstream applications.
• Chai works by cataloging flaws at the library level and propagating them across a cryptographic dependency graph, delivering efficiency gains.
• The researchers tested Chai on X.509, JWT, and SAML libraries.
• Chai discovered over 100 vulnerabilities in total.

Key Concepts Mentioned

• AI-based system
• cryptographic misuse vulnerabilities
• differential testing
• library level
• cryptographic dependency graph

Claims Made by the Document

• Chai is effective at discovering cryptographic misuse vulnerabilities.
• Chai can deliver efficiency gains by cataloging and propagating flaws across a cryptographic dependency graph.

Evidence Used

• The researchers state that Chai discovered over 100 vulnerabilities.

Methods / Approach

• AI-based system for differential testing
• cataloging flaws at the library level
• propagating flaws across a cryptographic dependency graph

Limitations Stated by the Authors

• Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

• The effectiveness of Chai might vary depending on the specific libraries and applications it is applied to.

Open Questions

• What is the exact process by which Chai improves precision for detecting real security issues?
• How does Chai repurpose commonly overlooked discrepancies as leads for tangible vulnerabilities?

Notes for Future Q&A

May include interpretation. Labeled where it does.

• The text provides a general overview of how Chai works but lacks specific details about its methods.

Raw Abstract / Excerpt

AI-assisted vulnerability discovery has proven effective for bug classes like memory safety, where instrumentation confirms memory violations and efficiently filters false positives. Many dangerous vulnerability classes, such as cryptographic misuse, however, lack any comparable instrumentation. In this work, we present Chai, an AI-based system that discovers and validates cryptographic misuse vulnerabilities through naturally occurring signals. To achieve this, Chai rethinks the classical technique of differential testing by leveraging AI to 1) improve precision for detecting real security issues in libraries, and 2) repurpose commonly overlooked discrepancies as leads for tangible vulnerabilities in downstream applications. In doing so, Chai inverts the prevailing paradigm of AI vulnerability discovery: instead of auditing one codebase for many flaws, it catalogs flaws at the library level and propagates them across a cryptographic dependency graph, delivering compounding efficiency gains. We evaluate Chai across X.509, JWT, and SAML libraries. Chai discovered a previously unknown critical vulnerability in an SSL library that powers billions of devices, along with security bugs in one library behind a major web browser and another in major Linux distributions. In total, these techniques surfaced over 100 vulnerabilities.