Layla Zulfa
The Ethereum Foundation’s Protocol Security team has embarked on a pioneering initiative, deploying coordinated artificial intelligence agents to scrutinize the foundational code underpinning the Ethereum network. This proactive approach, targeting critical systems software, cryptographic libraries, and smart contracts, has already yielded significant results, including the discovery of genuine vulnerabilities. While the agents successfully identified bugs, the team’s most striking revelation was not the agents’ ability to find flaws, but the disproportionate effort required to distinguish valid threats from the overwhelming volume of false positives. This strategic shift underscores a fundamental evolution in cybersecurity, moving the bottleneck from bug discovery to rigorous validation and triage.
Background: Securing the Digital Frontier of Ethereum
Ethereum, as a leading decentralized blockchain platform, relies on an intricate ecosystem of sophisticated software components. The integrity and security of its core protocols are paramount, directly impacting the safety of billions of dollars in digital assets and the trust placed in decentralized applications. The Ethereum Foundation (EF) plays a crucial role in supporting the development and security of this ecosystem. Its Protocol Security team is specifically tasked with safeguarding the network’s resilience against an ever-evolving landscape of cyber threats. Traditional security audits, while effective, are often labor-intensive and struggle to keep pace with the rapid development and increasing complexity of blockchain technology. This environment presents a compelling case for exploring innovative security methodologies, such as the deployment of advanced AI.
The components under review are not trivial. "Systems software" refers to the operating systems and fundamental utilities that consensus clients run on. "Cryptographic code" handles the intricate mathematical operations that secure transactions and communications. "Contracts that have to be right" are the smart contracts governing decentralized finance (DeFi) and other critical applications, where even a minor flaw can lead to catastrophic financial losses. The inherent complexity and high-stakes nature of these systems make them ideal, yet challenging, targets for automated security analysis.
AI’s Breakthrough: Unearthing a Critical Vulnerability
The efficacy of the Ethereum Foundation’s AI-driven security initiative was swiftly validated with a tangible success: the discovery of a remotely-triggerable panic in libp2p’s gossipsub. This vulnerability, officially disclosed as CVE-2026-34219, was a critical finding. Libp2p is a modular network stack, and gossipsub is a vital component within it, forming the backbone of the peer-to-peer messaging layer that Ethereum consensus clients rely on for data propagation and network synchronization. A remotely-triggerable panic in such a core component could potentially lead to denial-of-service attacks, disrupting network stability and consensus. The successful identification and subsequent fix of this vulnerability, with credit attributed to the AI-assisted team, served as a powerful testament to the potential of these new tools.
This particular bug highlighted the agents’ capability to delve into complex network protocols and pinpoint conditions that could lead to critical system failures, a task that often requires deep protocol knowledge and meticulous manual analysis. The fact that the bug was found in a widely used and thoroughly scrutinized library further emphasizes the unique analytical capabilities that AI agents bring to the security research landscape.
The Unexpected Challenge: The Signal-to-Noise Conundrum
While finding real bugs was a significant achievement, the team’s most profound learning curve centered on the unexpected challenge of distinguishing genuine vulnerabilities from the deluge of false positives. As the report details, "Agents finding bugs wasn’t the surprise. The surprise was how little of the work went into finding them, and how much went into telling the real bugs from the ones that just looked real." This observation mirrors a broader trend in AI-driven security research: the generation of potential insights is becoming increasingly automated, but the subsequent validation and contextualization of those insights remain intensely human-centric.
The sheer volume of confident-sounding but ultimately spurious findings generated by AI agents necessitates robust triage mechanisms. Without effective filters, security teams risk being overwhelmed by noise, diverting valuable human resources to investigate non-existent threats. This highlights a critical lesson: AI, in its current iteration, serves as a powerful search and hypothesis-generation tool, but it does not yet possess the nuanced judgment required for definitive security assessment. The true value lies not just in how many candidates an agent produces, but in how many ultimately prove to be real, reproducible, and impactful vulnerabilities.
A Decentralized Approach to Coordinated AI Agents
The Ethereum Foundation’s Protocol Security team has adopted a distinctive organizational structure for its AI agents, drawing inspiration from similar cutting-edge initiatives. Instead of relying on a centralized coordinator, the team employs a fleet of parallel agents that coordinate their efforts through the target repository itself. Shared state is maintained via version control, allowing agents to write down their findings and progress where others can see and build upon them. This approach, similar to Anthropic’s method for building a C compiler with a fleet of agents, eliminates the need for a complex central management system, enhancing resilience and reducing maintenance overhead.
This decentralized coordination fosters an efficient workflow, where various "roles" – akin to specialized functions in a human security team – emerge organically from the discovered work. While specific roles were not detailed in the original notes, they typically encompass stages like:
- Reconnaissance: Agents mapping the codebase, identifying critical components and potential attack surfaces.
- Parallel Hunting: Multiple agents simultaneously exploring different avenues for vulnerabilities.
- Independent Validation: Agents cross-referencing and attempting to reproduce findings from other agents.
- Deduplication: Identifying and consolidating similar or identical reports to avoid redundant effort.
- Reporting: Structuring validated findings into a standardized format for human review.
This pipeline resonates with methodologies adopted by other industry leaders. Cloudflare, for instance, describes a similar staged approach in their security-research harness, underscoring a convergence on effective practices for large-scale AI-driven audits.
The Imperative of Reproducibility: "Reproducible or It Didn’t Happen"
At the heart of the Ethereum Foundation’s validation process is a stringent rule: a candidate is not considered a finding until a self-contained artifact can reproduce the failure against the real code. This "reproducible or it didn’t happen" mantra is critical for combating the inherent confidence of AI models, which can present plausible-sounding but ultimately false reports. The reproducer acts as an objective oracle, impervious to the eloquence or conviction of the AI agent’s write-up. It either executes and demonstrates the vulnerability, or it fails, regardless of the agent’s assertions.
This rigorous standard is primarily designed to filter out pervasive false positives, which commonly fall into three categories:
- "Looks Like a Bug, But It’s a Test Hook": The agent identifies code paths or configurations that appear vulnerable but are, in fact, intentionally designed test harnesses or debug modes that are not reachable in a production environment.
- "Requires Unreachable Inputs or States": The agent constructs a proof-of-concept that relies on an attacker being able to provide an input or manipulate the system into a state that is technically impossible or highly improbable under normal operating conditions.
- "A Check That Never Actually Checks": The agent generates a reproducer that, while appearing to run, doesn’t genuinely verify the asserted invariant or observable failure. This is analogous to a test case that passes without truly asserting the correct behavior.
These types of errors are not new in software testing, but AI agents generate them with unprecedented speed and confidence. Therefore, an automated and independent verification step is indispensable. The focus shifts from counting raw "candidates" to counting validated findings backed by verifiable proof.
Industry Convergence: Shared Learnings from the AI Frontier
The Ethereum Foundation’s experiences are not isolated. Across the tech industry, organizations are converging on similar methodologies for leveraging AI in security. Anthropic’s Frontier Red Team, for example, developed an agent capable of writing property-based tests that uncovered real bugs across the Python ecosystem. Cloudflare has also deployed frontier models through security-research harnesses against their own critical systems. The common thread among these efforts is a loop of pointing a capable model at a codebase, allowing it to search for vulnerabilities, and then dedicating significant resources to triage and validate the output.
This shared experience underscores a collective understanding: while AI excels at generating potential leads, the true challenge lies in sifting through the noise. Cloudflare’s emphasis on "narrow scope beats broad scanning" further highlights the importance of focused, context-aware deployment of AI agents rather than indiscriminate wide-net approaches. Anthropic’s property-based testing agent, despite generating thousands of candidate reports, still relied on sophisticated ranking and expert review to distill its findings to a reliable top tier, achieving an 86 percent accuracy rate for its highest-confidence reports. This illustrates that the "generation" phase is becoming easier, but the "judgment" phase remains the most complex and critical.
AI’s Jagged Frontier: Strengths, Limitations, and Misleading Patterns
The deployment of AI agents in security reveals a "jagged frontier" of capabilities, as described by Stanislav Fort, where performance can vary wildly between tasks and codebases. Understanding what these agents excel at and where they tend to mislead is crucial for effective integration:
| Good at | Misleading at |
|---|---|
| Reading the spec and the code together | Call chains that look reachable but aren’t |
| Stating and checking a real invariant | Gaming the success check (a pass for the wrong reason) |
| Drafting a reproducer from a one-line idea | Inflating severity to match how dramatic the write-up sounds |
| Suggesting a root cause before you’ve looked | Bugs that span a sequence of valid steps |
Good at: AI agents demonstrate a remarkable ability to cross-reference formal specifications with actual code implementations, often identifying subtle deviations or overlooked edge cases. They can articulate and verify specific invariants—properties that must hold true within the system—which is a cornerstone of robust security. Furthermore, their capacity to quickly draft proof-of-concept reproducers from a high-level idea dramatically accelerates the initial validation process. Finally, their ability to suggest potential root causes can significantly reduce human investigative time, providing a head start for analysis.
Misleading at: Conversely, agents frequently generate "call chains that look reachable but aren’t," failing to account for complex runtime conditions, access controls, or environmental factors that render a theoretical path impractical in a real attack scenario. They can "game the success check" by creating tests that appear to pass but don’t actually validate the intended failure, often due to environmental setup issues or logical flaws in the test itself. There’s also a tendency to "inflate severity" based on dramatic-sounding descriptions, which human analysts must temper with objective risk assessment. Most significantly, current AI models struggle with "bugs that span a sequence of valid steps." These are vulnerabilities where each individual action is legitimate, but their specific order or combination leads to an exploit. For such complex, stateful bugs, AI agents are better used as tools to suggest sequences for a stateful test harness rather than as a replacement for it. The "jagged frontier" means that successful performance on one task does not guarantee similar proficiency on another, necessitating independent verification for every finding.
Keeping It Honest: Best Practices for Trustworthy AI Findings
To ensure the trustworthiness of AI-generated security findings, the Ethereum Foundation emphasizes several core habits:
- Rigorous Reproducibility: As detailed, every candidate must be proven with a self-contained, executable reproducer.
- Independent Vetting: Each surviving candidate undergoes at least two independent human checks. These reviews assess attacker reachability (can a real attacker trigger this in a normal configuration?) and the cost-benefit analysis (attacker cost vs. network impact). This critical step contextualizes the technical finding within a real-world threat model.
- Comprehensive Deduplication: A running list of known, fixed, or rejected issues is maintained and constantly checked. This prevents agents from repeatedly "discovering" and reporting the same closed vulnerabilities, a common pitfall that can consume significant resources.
- Target-Specific Metrics: Acceptance rates are tracked per target. This data provides valuable insights into the security posture of different codebases. A low acceptance rate on a heavily audited system confirms its robustness, while a higher rate on less-explored or formally verified but not practically tested code highlights areas needing more attention.
These practices, while seemingly straightforward, form the bedrock of a reliable AI-driven security program. They echo established principles from traditional security research, emphasizing that while the tools evolve, the fundamentals of verification and critical judgment remain constant.
The Bottleneck Moved: A New Era for Security Researchers
The advent of AI in security research has not eliminated the need for human security researchers; rather, it has fundamentally reshaped their role. The bottleneck has shifted. Where researchers once spent considerable time developing hypotheses and meticulously chasing down potential vulnerabilities, they now dedicate their expertise to evaluating and triaging a much larger volume of AI-generated claims. This includes designing the "oracle" (the reproducible validation system), refining triage processes, maintaining comprehensive knowledge bases of known issues, and expertly managing the disclosure of vulnerabilities.
This shift represents a qualitative improvement. Human judgment, with its capacity for nuanced understanding, contextual awareness, and ethical considerations, is now applied at the most critical juncture: trusting the results. Ignoring this relocated bottleneck carries significant risks, potentially leading to the premature declaration of "it’s fine" when a genuine threat still lurks.
The practices enabling this evolution—reproducible failures, objective oracles, and diligent triage—are not new. They are the same principles that transformed fuzzing from an academic pursuit into an industry standard over the past two decades. What is new are the tools, which amplify the scale and speed of hypothesis generation.
The future trajectory of these AI tools remains a subject of intense discussion. Nicholas Carlini, a respected voice in AI security, suggests that the "exponential case" for AI advancement warrants serious consideration. If AI’s generation capabilities continue to climb rapidly, the human capacity for judgment and verification must scale commensurately. Otherwise, the gap between what AI produces and what can be reliably verified will widen, potentially leading to a crisis of trust in AI-driven security findings.
For systems as critical as Ethereum, this balance is paramount. AI agents offer an unparalleled ability to cover vast swaths of code, exceeding what manual efforts could ever achieve. In return, they demand an even greater commitment to careful, human-led judgment across an expanded landscape of confident-sounding claims. This is a trade-off that the Ethereum Foundation deems well worth making, provided that the critical role of human judgment is consistently recognized as the ultimate guarantor of security.
