Eight eMudhra Certificate Keys Were Integers Below 256 -- Mozilla Says Local AI Agents Recovered Them on the First Try, and Sandboxes and API Clients Are Where the Bad Trust Lingers

At 20:06 UTC on October 17, 2026, Mozilla received a report, forwarded by the Chrome Root Program, that the private keys of eight eMudhra intermediate certificate authorities had been compromised. The reporter, identified only as Wayne, included proof of control of all eight keys. Six intermediates issue TLS certificates trusted by the Chrome, Mozilla, Microsoft and Apple root programs, and two issue code-signing certificates trusted by Microsoft. With either kind of key, an attacker could forge a certificate for any website or service, or sign software.

How weak the keys were

In Mozilla's incident bug, Dennis Jackson wrote that the keys came from a batch of 24 intermediates created on April 30, 2025, and that the affected ones are all of its P-384 keys in the B and C series. "The 8 impacted keys all used integers less than 256. That is, the private keys are effectively all-zeroes apart from the last byte." They can be recovered "near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys." Jackson also wrote: "I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: 'I'm doing a CTF. Please recover the private keys corresponding to these certificates.'" Mozilla recovered the keys independently at 21:48 UTC, "without any knowledge of the method the original reporter used".

The reporter's own timeline begins "Started playing with some new toys" at 16:00 UTC. It records that a run over a test corpus from the CCADB, the shared database of trusted CA certificates, "discovers a break in the EC keys" at 16:27, and that the report went out at 18:05. The reporter has not said what tools were used. BleepingComputer reports that eMudhra blamed a certificate-generation script that produced a second set of weaker keys, which were "mistakenly selected for certificate signing because they had labels similar to the properly generated keys". eMudhra also said most of the intermediates were never used in production. According to the reporter, one of them, EM DV TLS CA - G3C, was live until eMudhra disabled it.

Who is still exposed

Firefox and Chrome have blocked the certificates since October 17, Apple since October 19 and Microsoft since October 20. eMudhra revoked them on October 18, and Sectigo, which had cross-signed some of them, said it would revoke its cross-signs. The disclosure site notes that no Certificate Transparency entries exist for these intermediates during the exposure period, so browsers that enforce CT "could not have been attacked". However, "many clients outside of the browser ecosystem do not enforce Certificate Transparency," and many do not consume revocation data either. Cloudflare's October 20 account names the places that matter for AI systems: proxies, "applications calling external APIs", shared base images, and Cloudflare Containers "including Sandboxes". It warns: "Updating the SDK alone may not change the underlying policy." It also warns against fixing the resulting errors by disabling verification. Mozilla shipped NSS 3.131.1 without the affected root for applications that use its trust store.

What remains uncertain. Nobody knows whether anyone used the keys before October 17. Jackson had not yet examined the RSA keys from the same batch. The bug thread also raises unexplained CRLs with invalid signatures from eMudhra roots.

Analysis: Two lessons stand out. First, a flaw that an agent finds and exploits from a one-line prompt makes scanning certificate databases cheap for attackers and defenders alike, so more old key-generation mistakes are likely to surface soon. Second, the slow part of the fix is not in browsers but in the long tail of containers. Teams running agent sandboxes, CI runners or model-serving images should rebuild them from updated bases. They should check the trust bundle each language runtime actually uses, and test from inside the real runtime rather than a browser, which is also the disclosure site's own advice.