Finding the blind spot: How Canonical hunts logic flaws with AI

Canonical developed an internal AI-powered security auditing agent called Redhound that autonomously hunts for logic flaws in codebases. Unlike static analysis or fuzzing, Redhound reasons about missing checks and divergent validation paths. It operates in five phases: deterministic recon, threat modeling, iterative hypothesis generation, debunking, and impact assessment. In its first deployment against LXD, Redhound discovered three critical logic vulnerabilities (CVSS 9.1 each) in under a day — all of which had survived years of manual review. The three CVEs (CVE-2026-34177, CVE-2026-34178, CVE-2026-34179) involve certificate type escalation, incomplete VM option denylists, and backup restore desynchronization, each allowing a restricted user to escalate to host root. All have been patched and disclosed.