Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis

Jul 16, 2026

Cellular core networks (CNs) depend on an assumed internal trust zone, but cloud-native transitions weaken physical isolation and expose component interfaces to external attackers. Root-cause analysis of GitHub-reported flaws in open-source CN implementations reveals a recurring blind-trust pattern: missing syntactic validation, weak semantic invariants, and unchecked resource availability. These implicit trust errors (iTrues) can enable denial of service and session hijacking. To find iTrues, iFinder uses an LLM-driven multi-agent workflow with spec–code crosschecking and automated PoC generation refined by execution, uncovering 84 new vulnerabilities across seven implementations.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages19

Reading Time48 min

Introduction

Trust model fragility in cloud-native core networks

Need for systematic vulnerability discovery

Root-cause analysis of GitHub-reported flaws

iFinder for detecting implicit trust errors

Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong, XiaoFeng Wang Nanyang Technological University arXiv :2607 . 103 15v 1 [ cs .CR] 11 Jul 2026 Abstract Cellular core networks (CNs) are critical infrastructure, yet their internal security model has historically relied on physical isolation: interfaces between core components often operate within an assumed trust zone. As CNs transition to cloud-native deployments, this assumption weakens, expanding the attack surface and enabling external adversaries to reach previously internal interfaces. From a root-cause analysis of security flaws reported in GitHub issues for opensource CN implementations, we found a recurring pattern of blind trust among CN components. Components may omit syntactic validation, fail to enforce semantic invariants, or allocate resources without checking availability. Once internal interfaces become reachable, these weaknesses can lead to severe impacts such as denial of service and session hijacking. We call these vulnerabilities implicit trust errors (iTrue) . To detect iTrues and understand their security impacts, we designed iFinder, an LLM-driven multi-agent system that summarizes known flaws, distills them into detection patterns, and applies them to discover new iTrues in CN implementations. To suppress hallucinations produced by large language models (LLMs), we built an innovative strategy that crosschecks both 3GPP specifications and CN code to capture existing protection missed by the agents. Further, we developed a technique that uses LLMs to generate proof-of-concept (PoC) exploits for potential iTrues and iteratively refine the PoCs by automatically executing them against CN implementations and analyzing results. Running iFinder on seven prominent open-source CN implementations, we discovered 84 previously unknown vulnerabilities. Among them, 83 have already been confirmed and 81 have been assigned CVEs. Importantly, a session-hijacking flaw has been confirmed on real-world commercial 5G core networks. Our findings highlight the pervasiveness of iTrue risks across the cellular core networks and the urgent need for elevated protection within the original trust domains. We plan to make iFinder publicly available to help enhance the security of cellular core networks. 1 Introduction Cellular core networks are critical infrastructure underpinning everyday communication for billions of users. Vulnerabilities in these systems can cause large-scale service disruptions and compromise user privacy, making their security of paramount importance [1] . Historically, core network (CN) security has relied on physical isolation: internal interfaces between network functions operate within a trusted zone, often deployed without strong encryption or mutual authentication [2] . This trust model, however, is increasingly fragile. As operators migrate CNs to cloud-native deployments, the security perimeter shifts from physically isolated private infrastructure to shared cloud environments with complex network topologies [3] . Prior work has demonstrated that attackers can reach CN interfaces through cloud misconfigurations or by abusing GTP-U tunnels to inject arbitrary traffic [4] . These architectural changes expose internal interfaces to external adversaries, invalidating the implicit-trust assumption that has long underpinned core network security. Vulnerabilities in CN. Given these emerging attack surfaces, there is an urgent need for systematic approaches to uncover vulnerabilities in core network implementations. Yet, prior work has largely focused on analyzing interactions either between user equipment (UE) and CN components through the Non-Access Stratum (NAS) [5–9], or between base stations and the CN via protocols such as the Next-Generation Application Protocol (NGAP) [7, 9] and the GPRS Tunnelling Protocol User Plane (GTP-U) [9] . To

FAQs

What are implicit trust errors (iTrues) in cellular core networks?

iTrues are security vulnerabilities that arise when CN components implicitly trust each other’s inputs and states. They commonly result from missing syntactic validation, missing semantic enforcement, or failure to check resource availability once internal interfaces become externally reachable.

Why does the risk of iTrues increase during cloud-native deployments?

Cloud-native migration weakens the physical isolation that originally kept interfaces in a trusted zone. Misconfigurations and network tunneling abuse can make internal CN interfaces reachable from external adversaries, breaking the implicit-trust assumption.

How does iFinder detect and validate iTrues?

iFinder summarizes known flaws into detection patterns, then applies them to discover new iTrues in CN implementations. It reduces hallucinations by crosschecking 3GPP specifications and CN code, generates PoC exploits with LLMs, and iteratively refines them by automatically executing and analyzing results.

Jul 16, 2026

Upload by Seraphina