> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Critical Tor Vulnerabilities Patched Across All Tor Components From the "LLM Report Firehose"
- URL: https://www.privacyguides.org/news/2026/09/25/critical-tor-vulnerabilities-patched-across-all-tor-components-from-the-llm-report-firehose/
- Published: 2026-09-25T19:02:12.000Z
- Updated: 2026-09-25T19:02:12.000Z
- Description: Tor has released updates for "all components" of Tor that include severe vulnerabilities and bugs from the "LLM report firehose" and recommends "upgrading as soon as possible."
- Author: Fria Reyes
- Tags: News Briefs

Tor has [released](https://www.openwall.com/lists/oss-security/2026/09/24/2) updates for "all components" of Tor that include severe vulnerabilities and bugs from the "LLM report firehose" and recommends "upgrading as soon as possible."

Tor isn't the only project feeling the pressure from LLM-assisted. Many open-source projects have been bracing for the avalanche of AI security reports, many genuine but many others completely useless. Important open-source projects like [curl](https://github.com/curl/curl/blob/cc8df2b13d057a5d1e68380089eec220d7d0cef2/docs/BUG-BOUNTY.md) have had to close their bug bounty programs because of low-quality AI submissions.

Still, in the right hands, AI tools can massively speed up the rate at which bugs can be found.

The Linux kernel has been [removing](https://www.privacyguides.org/news/2026/06/18/linux-removes-support-for-legacy-appletalk-protocol-in-response-to-ai-patches/) older bits of code that aren't used much in order to reduce the attack surface in the face of LLM bug reports.

AI tools have even been able to [surface](https://www.privacyguides.org/news/2026/08/07/18-year-old-linux-kernel-bug-allows-full-system-takeover/) bugs from over a decade ago. Those would have otherwise sat around waiting for a determined enough attacker to find them.

Mozilla has [embraced](https://blog.mozilla.org/en/firefox/ai-security-zero-day-vulnerabilities/) using LLMs as defenders, claiming AI-assisted vulnerability discovery could finally turn the tide in the fight against attackers, but only after a front-loading your work with bug fixes for a while.

The vulnerabilities include memory corruption vulnerabilities, double-free bugs, and null pointer dereference bugs. Memory safety issues make up around [70%](https://security.googleblog.com/2024/10/safer-with-google-advancing-memory.html) of all vulnerabilities according to Google's numbers.

Tor has been working on a rewrite of Tor in the memory-safe language Rust. Named Arti, the rewrite claims to make the main Tor component safer, faster to develop, and cleaner.

The Tor Project [has said](https://gitlab.torproject.org/tpo/core/arti/-/blob/main/doc/FAQ.md) they will eventually replace the old C Tor codebase with the Rust Arti codebase. The Tor browser is based on Firefox, so it’s more reliant on the upstream developers to fix security issues.

The Tor project didn't release details on the vulnerabilities in order to give people time to patch to the fixed versions.

There's no mention that these exploits were used in the wild thankfully.

The current wave of AI security research is proving challenging for even the most well-funded projects, with Microsoft breaking records over and over again, nearing [1000 vulnerabilities](https://www.privacyguides.org/news/2026/09/10/microsoft-shatters-another-record-patching-973-vulnerabilities-in-september/) in some updates.

Even still, it's better that these bugs are found by the developers of the software themselves and fixed as soon as they're able than for them to sit around for decades unnoticed.