Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis
2026-07-11 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied security weaknesses in cellular core networks, which traditionally trusted internal components because they were physically separated. As these networks move to cloud setups, that trust is risky since external attackers can reach inside. They identified a pattern called implicit trust errors (iTrue), where components fail to properly check data or resources, leading to serious security problems. Using a new tool called iFinder, powered by AI, they found and confirmed many new vulnerabilities in open-source networks, including a flaw that affects real commercial 5G cores.
Cellular Core NetworksCloud-native DeploymentImplicit TrustSecurity VulnerabilitiesDenial of ServiceSession HijackingLarge Language Models5G Network SecurityProof-of-Concept Exploit3GPP Specifications
Authors
Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong, XiaoFeng Wang
Abstract
Cellular core networks (CNs) are critical infrastructure, yet their internal security model has historically relied on physical isolation: interfaces between core components often operate within an assumed trust zone. As CNs transition to cloud-native deployments, this assumption weakens, expanding the attack surface and enabling external adversaries to reach previously internal interfaces. From a root-cause analysis of security flaws reported in GitHub issues for opensource CN implementations, we found a recurring pattern of blind trust among CN components. Components may omit syntactic validation, fail to enforce semantic invariants, or allocate resources without checking availability. Once internal interfaces become reachable, these weaknesses can lead to severe impacts such as denial of service and session hijacking. We call these vulnerabilities implicit trust errors (iTrue). To detect iTrues and understand their security impacts, we designed iFinder, an LLM-driven multi-agent system that summarizes known flaws, distills them into detection patterns, and applies them to discover new iTrues in CN implementations. To suppress hallucinations produced by large language models (LLMs), we built an innovative strategy that crosschecks both 3GPP specifications and CN code to capture existing protection missed by the agents. Further, we developed a technique that uses LLMs to generate proof-of-concept (PoC) exploits for potential iTrues and iteratively refine the PoCs by automatically executing them against CN implementations and analyzing results. Running iFinder on seven prominent open-source CN implementations, we discovered 84 previously unknown vulnerabilities. Among them, 83 have already been confirmed and 81 have been assigned CVEs. Importantly, a session-hijacking flaw has been confirmed on real-world commercial 5G core networks.