Before a single user ever touched the code, AIW went through 9 security passes run by AI agents — 8 static analysis and 1 dynamic runtime test with real on-chain proof — and a re-check before release. Every finding documented. What is still open is listed too.
The nine passes below are a record of what was tested at the time. Before the open-source release the claims were run again against version 1.5.0, in an isolated sandbox with no real wallet. The passes had read the code route by route, so the re-check changed method: it plants marked secrets and searches everything AIW emits, plays a hostile AI model against a recording wallet, and fires a single blind request at every route that can move money. That found and fixed sixteen problems the passes had missed or left open, and it lists what is still open. It was carried out by an AI agent, like the passes themselves; AIW has not been audited by an outside security firm.
Found and fixed in the re-check, among others: a Confirm button could send a different payment from the one on its card when the AI guide prepared two at once; five overlapping Confirm clicks sent a Bitcoin payment five times; the AI guide could have a node sign a transaction; sweeping a wallet and paying over Lightning each took a single request; the swap tool was downloaded unverified; stored wallet passwords were being sent to the page; passwords and keys were stored in plain text.
Still open: no independent audit; no end-to-end run on a test network for this version, for any feature; the Windows installer is not code-signed. These tests show AIW will not send what you did not confirm. They do not show that a real payment completes correctly, so Lightning, swaps, exchange orders and Strike are switched off, and this build is a development checkpoint, not a release. The full list, with the evidence for every line here, is in SECURITY-STATUS-2026-10.md.
Eight passes of static analysis and one dynamic runtime test found vulnerabilities across all severity levels. All 55 were fixed. The pre-release re-check above found more, fixed them, and lists what remains open.
No third-party prebuilt image ever touches your keys. Each key-holding node is compiled into its own container from the project's official, GPG-signed release — the download pinned to a SHA-256 hash that is verified at build time, so a single altered byte fails the build. Each pinned hash was checked by hand against the project's own release signer when it was set; the build itself verifies the hash.
Each audit used the same codebase. Each found vulnerabilities the prior passes missed. That is why you keep going.
"The codebase is heavily hardened. Every primary attack class in the brief is already mitigated by explicit, documented controls. No high/critical findings. Findings below are residual hardening items (LOW / INFO)."
— SECURITY-AUDIT7.md, verdict
String(pin) !== String(STRIKE_PIN), leaving a timing side-channel the login/Decree/seed gates had already closed.{confirm:true} from loopback when neither dashboard nor wallet password was set.startsWith(PUBLIC_DIR) could match a sibling directory like <PUBLIC_DIR>-x. R4/R5 (XMR raw-proxy explicit auth re-check, Origin-less CSRF surface) raised as optional defence-in-depth — already neutralised by the spend-403 + fail-closed allowlist and SameSite=Strict.https://localhost carrying a valid Bearer token was accepted because the default MOBILE_ORIGINS allowlist is broad for the Android client.Not static analysis. Not code review. The wallet was running. The tests were real. Real stagenet transactions served as proof.
AIW was built by orchestrating AI agents — not by writing code manually. That means every security claim had to be verified by a different agent than the one that made it. The agent that fixes a bug will tell you the fix works. The agent that finds the bug will tell you if it doesn't.
The first Pass 9 auditor wrote "All findings resolved. Fixes verified." without running the tests. The second auditor ran the actual tests and found two High vulnerabilities still present — proven with real stagenet transactions. The third auditor independently re-verified the fixes on the deployed system.
That is the process. Not one pass. Not one agent. Trust the evidence, not the claim.
All the audit documents are published in full — only live credential values, process IDs and one real mainnet address were replaced with descriptive placeholders. The redaction log itemizes every change. Click any document to read it.
These documents invite scrutiny — that is the point. If you find a vulnerability, tell us privately first so it can be fixed before it is public. No bug bounty yet, but credit is given to anyone who wants it.