An AI agent found 84 flaws in 5G core software. Twenty-three still have no fix

What the paper actually reports

Five researchers at Nanyang Technological University pointed a multi-agent system called iFinder at seven open-source cellular core implementations. It came back with 84 previously unknown vulnerabilities. Developers confirmed 83 and 81 now carry CVE numbers.

The paper is Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis, by Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong and XiaoFeng Wang, submitted 11 July 2026 and accepted to USENIX Security 2026.

The bug class they name is the part worth understanding. Implicit trust errors, which they shorten to iTrue, are cases where one core component accepts input or state from another without checking it, because the interface between them was designed on the assumption of physical isolation. The authors break it into three concrete failures:

• Omitted syntactic validation. The field is parsed without checking it is well formed.
• Unenforced semantic invariants. The field parses, but nothing checks whether the value is legal in this state, or whether the sender is entitled to it.
• Unchecked resource allocation. A request allocates a UE context, a timer or a bearer structure without checking any remains.

Nothing here is memory corruption. Every one of these is a missing if.

The distribution nobody quotes

Thirty of the 84 are in the LTE core of a single project. More than a third of everything found, in 4G code that has been in production far longer than any 5G deployment and is carrying traffic for private networks today.

Memory safety is not the axis. The Go implementations produced 26 findings between them. These are logic flaws, and a memory-safe language does not prevent a missing entitlement check.

Twenty-five flaws are one pattern on one protocol: a PFCP handler reading a field that is not there. That is not seven codebases each getting unlucky. It is a single shared assumption, written down once in a specification that never required the check because the interface was never meant to be reachable.

How the session hijack works

The most serious finding was validated on commercial 5G cores, not only in a lab. It is in the UPF, the User Plane Function, which is the component that actually forwards subscriber traffic.

The UPF is programmed over the N4 interface using PFCP, the Packet Forwarding Control Protocol. The SMF sends it Packet Detection Rules: each PDR has an ID, a Precedence value, and a bound Forwarding Action Rule saying where matching traffic goes. Lower Precedence means higher priority.

The flaw is that the UPF does not check PDR ID uniqueness when handling a PFCP Session Modification Request.

PFCP Session Modification Request→ Create PDR   PDR ID: 1   Precedence: 10   FAR ID: → attacker tunnel

The number that matters is 23

Every write-up leads with 84. The number that changes anything is 23: flaws confirmed, catalogued, publicly numbered, and unfixed.

A CVE is a published description of what to look for. Twenty-three of them exist for software carrying voice and data, and the description is available while the fix is not.

That is not a maintainer failure. Patching 58 of 81 findings from one paper is a good showing for small volunteer teams. It is structural, and the shape is new.

The hallucination problem is worth noting, because it is the reason this is not another pile of false positives. iFinder maps each candidate to the protocol procedure it implements in the specification, then maps that procedure back to the codebase to recover the full execution context, so the agent can see whether a check exists elsewhere before claiming it is missing. Ninety-nine percent developer confirmation is the result of that step, not of the finding step.

Who actually runs these cores

The reflex is that this is a mobile operator problem. It is, and they have security teams. The exposure that gets missed is elsewhere.

Open5GS, free5GC and OpenAirInterface are what private cellular networks are built on. Manufacturing sites, ports, warehouses, hospital campuses, mining operations. The people running them chose 5G or private LTE because Wi-Fi could not cover the site, and they are now running telecom core software with the operational maturity of a factory network.

What this changes about disclosure

Coordinated disclosure was designed around a researcher finding a handful of issues and a vendor fixing them inside ninety days. It assumed finding was the expensive part.

If one group with one system can hand a maintainer eighty findings at once, ninety days is not a deadline, it is a fiction. The question for the next twelve months is not whether AI will find more vulnerabilities. It will. It is whether anything downstream of finding can absorb the volume, and on this evidence the answer is not yet.

For the defensive side of the same capability, see the guide on AI red teaming. The tooling that produced this paper is the tooling that will be pointed at your estate, by you or by somebody else. The same trust-the-caller shape appears in MCP tool access, where a protocol built for a trusted local process was exposed to an untrusted one.