The global telecommunications backbone is currently undergoing its most radical transformation since the invention of the cellular radio, swapping rigid physical hardware for the fluid complexity of cloud-native software. This massive architectural shift has effectively dismantled the traditional perimeter-based security models that once protected mobile cores, replacing them with a decentralized, software-defined environment. While this evolution is essential for the high-speed, low-latency demands of modern connectivity, it has also introduced a sprawl of code that is increasingly difficult for human auditors to verify manually.
As 5G becomes the universal standard for everything from autonomous vehicles to critical infrastructure, the security of its underlying core networks has never been more paramount. The central challenge lies in the sheer volume of the attack surface; the complexity of 5G and nascent 6G architectures creates hidden gaps where logic flaws can hide in plain sight. Industry experts are now questioning whether “agentic” artificial intelligence, which can reason and execute multi-step tasks autonomously, represents the only viable path forward for auditing and securing these vital communication systems against increasingly sophisticated threats.
The Challenge: Protecting Cloud-Native Mobile Architectures
The transition toward 5G introduces unprecedented flexibility by allowing network functions to run on standardized server hardware rather than proprietary black boxes. However, this flexibility also eliminates the physical boundaries that historically shielded mobile cores from external manipulation. Because these functions are now interconnected through web-standard protocols, they are vulnerable to the same types of cyber threats that plague the broader internet, but with the added risk of disrupting essential national telecommunications services.
Recent research has focused on bridging the divide between the rigorous theoretical specifications established by the 3rd Generation Partnership Project and the messy reality of actual software implementation. This is where the iFinder tool, developed by a team at Nanyang Technological University, enters the picture. By automating the discovery of vulnerabilities, iFinder addresses a critical need in the industry: the ability to ensure that the code running our mobile networks actually adheres to the complex security rules it was designed to follow.
Understanding the implications of this research is vital for the global telecommunications industry as it strives to prevent large-scale data breaches and session hijacking. The rise of open-source mobile core projects has democratized network deployment but has also exposed a lack of consistent security vetting across different platforms. Without tools like iFinder, the industry remains at risk of repeating the mistakes of previous generations, where security was often an afterthought bolted onto a functional system rather than a core design principle.
The Evolution of Telecommunications and the Rise of iFinder
To achieve a comprehensive audit of mobile networks, the researchers utilized an agentic AI architecture powered by Anthropic’s Claude, which was organized into a specialized four-stage pipeline. The first stage involved AI agents meticulously analyzing thousands of pages of technical specifications to establish a clear baseline of security requirements. This foundational step ensured that the AI had a deep understanding of the intended logic and security constraints of a mobile core network before any code analysis began.
Following documentation preparation, the pipeline moved into a matching phase where AI agents scanned popular open-source mobile core implementations for patterns indicative of logical flaws. This was followed by a vetting stage, where a dedicated filtering agent reviewed the potential flaws to eliminate false positives. The process concluded with an exploit generation stage, where a final agent developed proof-of-concept exploits and tested them in a controlled environment to verify the severity of the findings through iterative refinement and logging.
Research Methodology, Findings, and Implications
Methodology
The research pipeline was designed to mimic the cognitive workflow of a human security researcher but at a vastly accelerated scale. By utilizing the Claude model, the team allowed the agents to interact with the codebases of seven major open-source mobile core projects. This iterative process allowed the AI to not only identify potential errors but also to explain the technical reasoning behind why a specific section of code violated the 3GPP safety standards.
Findings
The study uncovered 84 distinct vulnerabilities across seven major open-source mobile core implementations, including projects like Open5GS and Free5GC. These discoveries led to the assignment of 81 Common Vulnerabilities and Exposures identifiers, highlighting a systemic weakness in modern mobile software development. One of the most alarming discoveries was a critical flaw in the User Plane Function that could allow an attacker to reroute a subscriber’s internet traffic to a malicious server, effectively hijacking their data session without their knowledge.
Beyond individual bugs, the research identified broader structural issues, such as implicit trust problems between internal network functions. In many cases, components of the mobile core were found to lack internal verification, assuming that any message received from within the network was inherently legitimate. This vulnerability is particularly dangerous in cloud environments where a single compromised container could potentially poison the entire system. Moreover, the study revealed that many current 5G security flaws are actually carry-overs from 4G codebases.
Implications
The efficacy of the agentic approach was demonstrated by a massive increase in detection precision, which jumped from 28 percent with standard AI prompting to 75 percent using the multi-agent pipeline. This suggests that the future of network security lies not in simple AI assistants, but in specialized ecosystems of agents that can cross-reference documentation with code in a way that exceeds human capacity. The implications for the industry are clear: the old ways of boundary-based security are no longer sufficient, and a transition toward a Zero Trust architecture is mandatory.
Furthermore, the research highlighted that relying on encryption alone, including the deployment of Post-Quantum Cryptography, is not a complete solution. Even if the content of a data packet is unreadable, metadata leaks and traffic rerouting remain viable threats if the underlying authentication between network nodes is missing. This realization must drive a reform in how standardization bodies manage documentation, making security rules more transparent and accessible to the developers who must implement them in the real world.
Reflection and Future Directions
Reflection
Reflection on the study demonstrated that agentic AI can indeed outperform traditional manual audits by identifying complex logical flaws that often escape human notice. The researchers noted that while manual auditing is thorough, it is simply too slow to keep up with the rapid pace of software updates in a cloud-native world. However, the process also underscored the difficulty of balancing rigorous security protocols with the extreme low-latency requirements of 5G, as every additional verification step can potentially introduce delays in network performance.
The research also faced significant hurdles due to the fragmented and voluminous nature of 3GPP documentation. Initially, these complications hindered the establishment of clear security rules for the AI to follow, suggesting that the path toward fully automated security is still evolving. Despite these challenges, the study proved that a structured, multi-agent AI system can navigate linguistic ambiguity in technical standards to find concrete errors in code, marking a major milestone in the application of large language models to cybersecurity.
Future Directions
Future research should aim to apply these agentic AI techniques to proprietary, closed-source carrier software to determine if similar vulnerabilities exist beyond the open-source community. Since many major telecommunications providers use custom versions of these core network functions, it is essential to know if these same logical flaws have been replicated in commercial environments. This expansion will be vital for understanding the true scope of the vulnerability in the global communications infrastructure as it stands today.
Additionally, there is a pressing need to move from pre-deployment audits to real-time defensive measures. Developing AI agents that can live within the network core to detect and mitigate exploitation attempts as they happen would provide a dynamic layer of security that static audits cannot offer. This proactive approach would allow networks to heal themselves or isolate compromised components before a vulnerability can be fully exploited by a threat actor, creating a more resilient ecosystem.
Securing the Global Communications Infrastructure
The landmark study conducted by the researchers at Nanyang Technological University provided a definitive look at the current AI arms race in the field of cybersecurity. By identifying nearly 100 vulnerabilities, the investigation confirmed that as networks became software-defined, they simultaneously became more susceptible to the automated discovery of logical flaws. The team demonstrated that the adoption of mandatory mutual authentication and proactive AI-driven auditing tools represented the only way to safeguard the long-term integrity of global mobile communications.
Ultimately, the study contributed a clear blueprint for defenders to utilize the same sophisticated technologies as potential attackers. The researchers established that the future of 5G security depended on a fundamental shift in mindset, moving away from legacy trust models toward a more rigorous, automated verification process. This research served as a crucial call to action for standards bodies and operators alike to modernize their defenses before the next generation of connectivity was fully deployed across the globe.