The Ethereum Foundation’s Protocol Security team has unveiled a sophisticated strategy for leveraging coordinated Artificial Intelligence (AI) agents to probe the security of critical protocol code. This innovative approach, detailed in a recent publication, not only successfully identified real-world bugs, including a notable vulnerability in the libp2p gossipsub protocol (disclosed as CVE-2026-34219), but also highlighted a significant shift in the cybersecurity auditing landscape. The primary surprise was not the detection of flaws, but the substantial effort required to distinguish genuine vulnerabilities from AI-generated false positives. This methodology offers valuable insights for client teams and security researchers aiming to implement similar AI-driven auditing techniques.
The Ethereum Foundation’s initiative aligns with a broader trend in the cybersecurity community. Companies like Anthropic, with their Frontier Red Team, have developed AI agents capable of generating property-based tests that have unearthed vulnerabilities across the Python ecosystem. Cloudflare has also employed advanced AI models within a security research framework to scrutinize their internal systems. The common thread across these efforts is a cyclical process: deploying a capable AI model against a codebase, allowing it to search for weaknesses, and meticulously triaging the results. The paramount challenge, therefore, lies in effectively managing the volume of AI-generated output to isolate critical findings from the "confident-sounding noise."
This report focuses on the enduring methodologies rather than transient tooling, acknowledging the rapid evolution of AI-driven auditing technologies. The core concept is to treat AI agents as advanced search tools, akin to fuzzers, but with a crucial distinction: the output. While fuzzers typically yield a crash and a stack trace, AI agents provide a more comprehensive report. This includes detailed write-ups outlining call chains, claims of impact, suggested severity levels, and, most importantly, verifiable artifacts such as proof-of-concept exploits that can be executed against the live code. This richness of detail enhances the readability and trustworthiness of the findings, with the running proof-of-concept serving as the ultimate arbiter of validity. The emphasis is on the quality and verifiability of the findings, not merely the quantity of candidates generated by the agents.
Organizing the AI-Driven Audit Pipeline
The Ethereum Foundation’s Protocol Security team employs a distributed approach to orchestrate its AI agents. Multiple agents are run concurrently against a single target system. Coordination is achieved through the codebase’s repository itself, leveraging version control for shared state and eliminating the need for a centralized management process. An agent documents its findings, performs its work, and commits the results, enabling other agents to observe and build upon the progress. This decentralized coordination model was inspired by Anthropic’s work on building a C compiler with a fleet of AI agents, a method that minimizes single points of failure and maintenance overhead.
The workflow mirrors a pipeline observed in similar initiatives, including Cloudflare’s description of their cybersecurity research process. This pipeline typically involves several stages: reconnaissance, parallel exploration by agents, independent validation of potential findings, deduplication of reports, and, finally, comprehensive reporting. Each stage is designed to progressively refine the raw output from the AI agents into actionable security intelligence.
A candidate vulnerability, before it is recognized as a confirmed finding, must meet a rigorous set of criteria. This structured approach ensures that the AI’s output is concrete and testable, preventing it from relying on vague assessments of risk. The essential components of a candidate finding include:
- Target: The specific component and entry point within the system that a potential attacker could realistically access.
- Invariant: A fundamental property or principle that must hold true within the system’s operation.
- Mechanism: The precise method or sequence of actions through which the invariant might be violated.
- Success: Observable and concrete proof of the vulnerability, such as a program crash, a system stall, or the acceptance of invalid input.
- Reproducer: A self-contained artifact, typically code or a script, that can reliably trigger the identified failure when executed against the actual target system.
- Dedup (Deduplication): A unique identifier or key associated with the finding, crucial for preventing multiple agents from investigating the same issue.
This schema is deliberately designed to enforce specificity and a clear definition of "done." By requiring agents to articulate an observable proof of concept, the process guards against subjective interpretations and "gut feelings" about potential risks.
Reproducibility: The Cornerstone of Trust
The most critical principle guiding this AI-driven security audit process is the absolute requirement for reproducibility. A candidate vulnerability is not considered a legitimate finding unless a self-contained artifact exists that can reliably reproduce the failure within the target code. Furthermore, this reproducer must be executable by individuals other than the agent that discovered it, ensuring its validity and independence from the AI’s internal logic or training data biases.
The reproducer acts as an objective arbiter, irrespective of the AI’s descriptive confidence or the perceived complexity of its write-up. It either functions as intended, demonstrating the vulnerability, or it fails, indicating a false positive. The true value of this reproducible proof lies in its ability to weed out the significant number of false positives generated by AI models. The Ethereum Foundation team has identified three recurring categories of false positives that agents frequently encounter:
- False Positive Type 1: Reachable but Not Exploitable: The AI identifies a code path that theoretically could lead to a failure, but in practical, real-world scenarios or with standard network configurations, this path is inaccessible to attackers.
- False Positive Type 2: Gaming the Success Check: The AI generates an output that superficially appears to trigger a vulnerability, but upon closer inspection, it satisfies the success criteria through an unintended or irrelevant mechanism, effectively a "pass for the wrong reason."
- False Positive Type 3: Out-of-Scope or Non-Applicable Findings: The AI reports a vulnerability that exists in a component or context that is not relevant to the core functionality or security posture of the target system, or it misinterprets the system’s intended behavior as a vulnerability.
This phenomenon is analogous to traditional software testing, where a test case might pass not because the software is correct, but because the test itself is flawed or does not adequately exercise the code’s intended functionality. The challenge with AI agents is their capacity to generate these misleading "tests" at an unprecedented scale and with the same level of apparent confidence as genuine findings. Consequently, the verification process must be automated and rigorous to prevent the AI from self-deceiving.
The Signal-to-Noise Ratio: The True Challenge
A substantial portion of the effort in AI-driven security auditing is dedicated to managing the signal-to-noise ratio. The vast majority of candidate findings generated by AI agents are ultimately incorrect, duplicates of already identified issues, or outside the defined scope of the audit. This is not a deficiency of the AI methodology itself but rather an inherent characteristic of how these systems operate. The primary objective is to swiftly discard incorrect candidates while providing irrefutable proof for genuine vulnerabilities.
Each candidate that progresses through the initial filtering undergoes at least two independent validation checks. The first assesses whether a real-world attacker, operating under typical network configurations, could realistically trigger the vulnerability. The second evaluates the cost-benefit analysis: the resources required for an attacker to exploit the vulnerability versus the potential impact on the network or system if the exploit is successful. A vulnerability that can be triggered by any individual peer holds different implications than one requiring specialized access or significant computational resources.
Furthermore, all findings are cross-referenced against a meticulously maintained list of known, previously fixed, or already rejected vulnerabilities. This ongoing record-keeping is essential to prevent the AI agents from repeatedly "rediscovering" and reporting issues that have already been addressed.
The acceptance rate of AI-generated candidates varies significantly depending on the target system. Auditing mature, extensively scrutinized codebases typically results in very low acceptance rates, a finding that in itself provides valuable assurance. The conclusion, "we conducted a thorough investigation and found no significant vulnerabilities," is a meaningful security outcome. Conversely, when applied to less explored codebases or systems with formal verification, where machine-checked proofs might cover a model but not the deployed bytecode, a higher proportion of candidates may pass initial scrutiny.
Industry leaders echo this sentiment. Cloudflare’s experience suggests that a focused, narrow scope for AI-driven audits is more effective than broad, indiscriminate scanning. Anthropic’s property-based testing agent, for instance, generated approximately a thousand candidate reports, but subsequent ranking and expert review narrowed this down to a select group of highly reliable findings, with an approximately 86% validation rate for that top tier. This underscores that the AI’s generative capability is the less demanding part of the process; the true bottleneck lies in the sophisticated triage and verification required to discern the genuine threats.
AI’s Strengths and Limitations in Security Auditing
A clear-eyed understanding of what AI agents excel at and where they tend to mislead is crucial for effective implementation. The current capabilities and limitations can be summarized as follows:
| Good At | Misleading At |
|---|---|
| Reading specifications and code in tandem. | Identifying call chains that appear reachable but are not in practice. |
| Stating and verifying concrete invariants. | "Gaming" the success check, leading to false positives. |
| Drafting reproducible proof-of-concept exploits from minimal initial ideas. | Inflating the reported severity to match the dramatic tone of the write-up. |
| Suggesting potential root causes prior to in-depth human analysis. | Detecting vulnerabilities that depend on a precise sequence of otherwise valid operations. |
The effectiveness of AI agents is not uniform across all types of security tasks. Stanislav Fort’s research into evaluating various AI models on real-world vulnerabilities describes this variability as a "jagged frontier." An agent that can successfully reconstruct a full exploit chain for one codebase might struggle with basic data-flow tracing on another. This inconsistency necessitates that every candidate finding be individually scrutinized and validated, reinforcing the need for a robust verification process.
Perhaps the most critical distinction lies in the last row: single-agent sessions are adept at one-shot reasoning but often fall short when dealing with vulnerabilities that manifest across a sequence of operations, where each individual step is valid, and only the temporal ordering creates the exploit. In such cases, the AI agent’s role shifts from being the primary search tool to a facilitator, identifying sequences that warrant further investigation using a dedicated stateful test harness. When employed in this advisory capacity, AI proves highly effective. However, relying on AI agents as a complete replacement for such harnesses risks overlooking the most insidious and costly vulnerabilities – those that only surface through complex, multi-step interactions.
Maintaining the Integrity of AI-Driven Findings
Several foundational practices are instrumental in ensuring the trustworthiness of findings generated by AI security agents. These practices, while straightforward, are critical for the integrity of the audit process:
- Rigorous Reproducibility Checks: As previously emphasized, a candidate finding is only valid if it can be consistently reproduced by independent parties. This involves ensuring that the provided exploit code or test case works reliably against the target system without requiring specialized knowledge or environments.
- Automated Oracle Maintenance: A continuously updated database of known vulnerabilities, system invariants, and expected behaviors (the "oracle") is essential. This oracle serves as a reference point to quickly identify and dismiss duplicate or irrelevant findings, preventing the AI from wasting resources on already-addressed issues.
- Independent Validation and Triage: All candidate findings must undergo a multi-stage review process involving human security experts. This triage ensures that the AI’s claims are thoroughly examined for accuracy, exploitability, and impact, going beyond the automated checks.
- Clear Scope Definition and Enforcement: Defining the precise boundaries of the audit—which components, versions, and configurations are in scope—is paramount. AI agents must be guided by these boundaries, and their findings must be evaluated against them to prevent out-of-scope vulnerabilities from being flagged.
- Continuous Model Evaluation and Fine-tuning: The performance of AI models is not static. Regular evaluation of their effectiveness, identification of common failure modes, and subsequent fine-tuning are necessary to improve their accuracy and reduce false positives over time.
- Transparent Disclosure Procedures: Establishing and adhering to clear, ethical, and timely disclosure protocols for any confirmed vulnerabilities is crucial. This ensures that responsible parties are notified and have adequate time to implement fixes before vulnerabilities are made public.
The Evolution of the Bottleneck
The advent of AI in security auditing has not rendered human security researchers obsolete; rather, it has fundamentally shifted the nature of their work. The time previously dedicated to formulating hypotheses and manually tracing potential exploit paths is now redirected towards a more complex, large-scale task: judging the veracity and significance of AI-generated claims. This involves building and maintaining the "oracles" that guide the AI, executing the sophisticated triage processes, managing the database of known issues, and overseeing the disclosure of confirmed vulnerabilities.
The bottleneck has not disappeared; it has migrated. It has moved from the act of finding bugs to the critical task of trusting the results, a more appropriate location as it is precisely where human judgment and expertise are indispensable. However, this new bottleneck demands careful management; overlooking its significance can lead to the erroneous conclusion that systems are secure when they are not.
The practices that underpin the success of AI-driven auditing are not novel. Reproducible failures, robust oracles, and meticulous triage are the same principles that elevated fuzzing from a research curiosity to a standard industry practice over the past fifteen years. The tools are new, but the underlying methodologies remain consistent.
The pace of AI tool development remains an open question. Nicholas Carlini, a respected figure in AI security and a former skeptic, argues for serious consideration of exponential growth trajectories in AI capabilities, even while acknowledging inherent uncertainties. If AI’s ability to generate potential vulnerabilities continues to accelerate, the equally critical ability to verify and judge those findings must advance in tandem. Failure to do so will widen the gap between what AI can produce and what can be reliably confirmed, diminishing the overall effectiveness of these tools.
For the foundational systems underpinning Ethereum, this capacity for rigorous judgment is paramount. AI agents enable the exploration of vastly larger attack surfaces than would be feasible through manual efforts alone. In return, they necessitate a more discerning and comprehensive approach to evaluating the generated output, which consists of a rapidly growing volume of seemingly credible claims. This exchange—increased breadth of exploration for heightened demands on critical judgment—represents a valuable trade-off, provided that the ultimate product—verified security—remains the central focus.
