84 New 5G Core Vulnerabilities — and Why This Is Just the Beginning

A team of researchers — Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong, and XiaoFeng Wang — has just shown what happens when you point an LLM-driven multi-agent system at telecom core network code. The result: 84 previously unknown vulnerabilities across seven open-source 4G/5G core implementations. Of those, 83 have already been confirmed by developers and 81 have been assigned CVEs — including a session-hijacking flaw confirmed on a real-world commercial 5G core. The work, titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis," has been accepted to USENIX Security 2026.

Why telecom looked safer than it was

Cellular core networks were designed on an assumption that no longer holds: that the interfaces between components (AMF, SMF, UPF, and the rest) sit inside a physically isolated trust zone, reachable only by other trusted network functions. As operators move cores to cloud-native, virtualized, and multi-vendor deployments, that isolation erodes. Interfaces once buried inside a carrier's private infrastructure become reachable from more places, and adversaries who get a foothold anywhere in the chain can reach components never designed to defend themselves against hostile input.

Telecom's low historical vulnerability count was often mistaken for security. In reality, it reflected three barriers to research, not the absence of flaws: proprietary platforms that were hard to access, protocols (PFCP, GTP-C, NAS, NGAP) that required specialized expertise few security researchers had, and manual code auditing that simply didn't scale across the size and complexity of core network codebases. Open-source implementations like free5GC, Open5GS, OAI, and UERANSIM lowered the access barrier over the past few years, but the expertise and scale problems remained — until AI agents started closing that gap too.

What the researchers actually built

The system, called iFinder, targets a specific bug class the authors name "implicit trust errors" (iTrue): cases where one core component blindly trusts input or state from another, omitting syntactic validation, failing to enforce semantic invariants, or allocating resources without checking availability. The team started by mining GitHub issues from open-source core implementations for root causes of previously reported flaws, then used that pattern set to seed a multi-agent pipeline with four stages.

A preprocessing stage extracts procedures and message schemas from 3GPP specifications and summarizes known bug patterns from GitHub issue history. A discovery agent locates where a given information element is used in the code and constructs execution paths, flagging candidate iTrues. A vetting agent locates the relevant procedure in the spec, expands context, and reevaluates feasibility to filter out false positives — this is the step that matters most, since a known failure mode of LLM-based vulnerability hunting is confident hallucination. The researchers address it by cross-checking both the 3GPP specification and the actual code, catching protections the agent might otherwise miss. Finally, an exploitation agent derives an attack vector, generates a proof-of-concept, and runs it against a testbed in a test-and-refine loop: execute, analyze logs, refine, repeat, until the exploit succeeds or a testing budget runs out.

Running this pipeline against seven prominent open-source core implementations surfaced the 84 new vulnerabilities, concentrated in the PFCP (Packet Forwarding Control Protocol) and GTP-C (GPRS Tunnelling Protocol – Control plane) interfaces. The dominant patterns were missing validation and improper handling of invalid or duplicate references — for example, a UPF that accepts a duplicate Packet Detection Rule and reorders forwarding rules by precedence without verifying the request's legitimacy, letting an attacker on the N4 or N6 side hijack a session's uplink traffic. The impacts break down into two buckets: denial of service against network functions, and session hijacking that lets an attacker redirect a subscriber's traffic to themselves.

Reading this as a policy signal, not just a research result

The technical result is notable on its own, but the more consequential story is what it demonstrates about the trajectory of vulnerability discovery in critical infrastructure. AI agents don't need to invent new attack techniques to be dangerous here — they need to make existing, tedious analysis cheap enough to run at scale. That's exactly what iFinder does: it automates the cross-referencing of dense 3GPP specifications against sprawling C/Go codebases, a task that previously required rare, dual-domain expertise in both telecom protocols and security research.

That capability cuts both ways, and the direction it cuts depends entirely on who deploys it first and what they do with what they find. In the best case, this kind of tooling becomes standard in telecom vendors' and operators' own security pipelines, and researchers who find flaws this way follow coordinated disclosure — as the iFinder team did, working with maintainers to confirm and patch 83 of 84 findings before publication, and securing CVEs for 81. That's the outcome this paper actually models: responsible use of an automated capability, disclosed through normal channels, strengthening the ecosystem it was pointed at. Given that a session-hijacking variant was confirmed against a real, operational commercial 5G core, the stakes of getting disclosure right were not hypothetical.

In the worse case, the same class of tooling — which requires no more than an LLM, the 3GPP specs (which are public), and access to source or binary code — ends up in the hands of actors with no disclosure incentive at all, against carriers running the same open-source cores (or closely related proprietary derivatives) without a patching cadence to match. Session hijacking and DoS against core network functions are not abstract risks for telecom: they translate into surveillance, service outages, and infrastructure that many other sectors (finance, emergency services, IoT) depend on being reachable and trustworthy.

The takeaway

This paper is best read as an early data point in a trend, not a one-off event. The barriers that kept telecom's disclosed vulnerability count artificially low — proprietary access, protocol expertise, and unscalable manual review — are exactly the barriers LLM-driven agents are built to erode. Operators and vendors should expect more results like this one, from more research groups, more often, and should treat the direction of the next disclosure — coordinated versus exploited-in-the-wild — as a matter of who moves first, not whether this kind of discovery happens at all.

Source: Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong, XiaoFeng Wang, "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis," to appear in USENIX Security 2026. arXiv:2607.10315