Summary:

Zcash founder Zooko Wilcox says Anthropic's Mythos AI model found no additional serious vulnerabilities after reviewing the protocol following the Orchard shielded pool incident.
The audit was requested by Shielded Labs, which continues to work on strengthening Zcash's security after patching a previously disclosed forgery bug.
The Orchard vulnerability was discovered with the help of Anthropic's Claude Opus 4.8 model, but developers said there is no evidence it was ever exploited or used to create unauthorized ZEC.
The update comes as AI takes on a growing role in blockchain security, even as advanced AI models also raise new cybersecurity concerns.
Crypto security remains under pressure, with DeFiLlama reporting $634 million in crypto hacks during April alone.

Privacy-focused cryptocurrency Zcash has received another vote of confidence after an artificial intelligence-powered security review found no additional serious vulnerabilities in the protocol. The update comes only weeks after developers fixed a high-profile flaw in Zcash's Orchard shielded pool, a discovery that briefly raised questions about the integrity of one of the industry's longest-running privacy networks. According to Zcash founder Zooko Wilcox, a follow-up audit performed using Anthropic's new Mythos AI model did not uncover any further critical security problems. In a post shared on X, Wilcox thanked Anthropic for assisting with the review and confirmed that the audit had been requested by Shielded Labs, a Swiss-based non-profit that supports Zcash development. He wrote:

"Thanks, Anthropic, for helping protect Zcash users. At Shielded Labs's request, they ran a security audit of Zcash with Mythos. It did not find any more serious bugs in the Zcash protocol. Shielded Labs and others are continuing security hardening work." Source

The statement provides some reassurance for users after the Orchard vulnerability became one of the most discussed security issues surrounding Zcash in recent months. While no software can ever be considered permanently bug-free, the absence of additional serious findings suggests the known issue was isolated rather than part of a wider pattern of flaws. Shielded Labs has also indicated that security reviews will continue even after the latest audit, highlighting an ongoing effort to strengthen the protocol rather than treating the review as a final checkpoint.

How the Orchard vulnerability was discovered and why it mattered

The latest audit follows an emergency response that began on June 3, when Zcash developers temporarily suspended Orchard shielded transactions after identifying a vulnerability inside the protocol's newest privacy pool. The flaw originated from a forgery bug that had existed within the Orchard shielded pool for approximately four years. Security researcher Taylor Hornby identified the issue with assistance from Anthropic's Claude Opus 4.8 AI model, demonstrating how advanced language models are increasingly being used to analyze highly complex cryptographic systems. Developers responded quickly by deploying an emergency network upgrade later the same day, restoring Orchard functionality after patching the vulnerability. According to the Zcash Foundation, the incident did not result in any confirmed exploitation. The foundation said there was no evidence that attackers created unauthorized ZEC, no indication that the vulnerability had ever been abused on the live network, and no impact on users' privacy protections.

Although the exploit was never observed in practice, its theoretical existence carried serious implications because privacy-focused cryptocurrencies depend heavily on cryptographic guarantees. Even an unexploited vulnerability capable of affecting supply integrity demands immediate attention. That concern was reflected in the market shortly after the disclosure, with several high-profile investors publicly reducing their ZEC exposure while developers worked to reassure the community that the issue had been contained. The successful emergency patch, followed by an independent AI-assisted review, marks another step toward restoring confidence in the protocol.

AI becomes both a security tool and a new cybersecurity challenge

The Zcash audit also highlights a broader shift taking place across the cryptocurrency industry. Artificial intelligence is increasingly being used to identify software vulnerabilities that traditional audits might overlook. Large language models are proving capable of reviewing millions of lines of code, spotting subtle logical errors, and assisting researchers with complex cryptographic analysis. Anthropic has positioned its new Mythos model specifically for advanced software security work. Earlier this week, the company introduced the first public version of Claude Mythos, also known as Fable 5, after previously stating that the model had identified more than 10,000 high or critical-severity vulnerabilities across systemically important software. The announcement attracted significant attention throughout the cybersecurity community, with some researchers questioning whether releasing such a powerful vulnerability-discovery tool could create new risks if abused. Anthropic later explained that the publicly available version includes safeguards designed to redirect certain cybersecurity-related requests to Claude Opus 4.8, reducing the likelihood of misuse.

Despite those precautions, concerns have continued. On Friday, Anthropic announced that access to both its Fable 5 and Mythos 5 models had been suspended following a United States government export control directive citing national security considerations. The timing illustrates a growing reality for both blockchain developers and cybersecurity researchers. The same AI systems capable of strengthening critical infrastructure can also accelerate vulnerability discovery in ways that require careful oversight. That balance has become increasingly important as attacks against crypto protocols remain costly. According to DeFiLlama, crypto hacks totaled approximately $634 million in April, making it the largest monthly loss since the Bybit exploit resulted in roughly $1.4 billion in damages during February 2025. For Zcash, the latest findings offer a positive development after weeks of heightened scrutiny. The patched Orchard vulnerability, combined with an independent AI-assisted review that uncovered no further serious issues, gives developers additional confidence as they continue strengthening one of crypto's oldest privacy-focused networks.