Researchers from Nanyang Technological University deployed the AI-driven system iFinder against software managing 4G and 5G networks, discovering 84 previously unknown vulnerabilities. Developers confirmed 83 of the findings, with 81 receiving CVE identifiers. Only 58 issues have been patched so far, leaving 23 confirmed vulnerabilities with CVE numbers awaiting fixes.
The most severe flaw enables session hijacking by injecting a network rule that reuses an existing identifier but carries a higher priority, bypassing uniqueness checks and redirecting subscriber traffic to the attacker. The attack was fully reproduced on OpenAirInterface and validated in two commercial 5G networks. One vendor has already released a patch for CVE-2026-8233, while the second continues remediation work.
Researchers also demonstrated that control commands can be hidden inside regular phone traffic using a valid SIM card. This technique succeeded against five of seven open-source cores tested. The iFinder framework uses three coordinated AI agents: the first scans for unvalidated inputs, the second cross-references findings against 3GPP standards, and the third generates, executes, and refines exploits after failures.
Although effective, the system is not fully autonomous. Out of 22 known vulnerabilities, iFinder detected 15, while roughly one-quarter of its alerts proved to be false positives. All results therefore underwent manual review and were supported by working proof-of-concept exploits.
Project responses varied. Open5GS, SD-Core, and free5GC have begun issuing patches, whereas three of the seven tested open-source projects have released no fixes to date.
