clet.xyz

The Ethereum Foundation’s Protocol Security team has achieved a significant breakthrough in identifying vulnerabilities within critical blockchain infrastructure by deploying coordinated Artificial Intelligence (AI) agents against real-world protocol code. This innovative approach, detailed in a recent advisory, has not only uncovered actual bugs, including a publicly disclosed vulnerability in the widely-used libp2p gossipsub protocol (CVE-2026-34219), but has also illuminated the crucial challenge of distinguishing genuine threats from sophisticated false positives. The findings offer valuable insights for client teams and security researchers aiming to leverage similar AI-driven auditing methodologies.

The core revelation from the Ethereum Foundation’s experiment was not the ability of AI agents to find bugs—a capability that has been increasingly anticipated—but rather the sheer efficiency with which these agents operated and the substantial effort required to filter actionable findings from a deluge of plausible-sounding, yet ultimately incorrect, reports. This nuanced outcome underscores a fundamental shift in the cybersecurity landscape, where the generation of potential vulnerabilities is becoming increasingly automated, placing a premium on human expertise for validation and triage.

The Genesis of AI-Driven Security Audits

The initiative by the Ethereum Foundation’s Protocol Security team is part of a broader trend across the technology sector. Leading organizations are converging on a common methodology for utilizing advanced AI models in security research. Anthropic’s Frontier Red Team, for instance, developed an AI agent capable of writing property-based tests, successfully identifying numerous bugs within the Python ecosystem. Similarly, Cloudflare has deployed frontier models within a dedicated security research harness to probe their own systems. This shared approach—directing powerful AI models at codebases, allowing them to explore, and then meticulously analyzing the output—highlights a consensus on the potential of this technology.

The Ethereum Foundation’s work builds upon this foundation by focusing on systems that are indispensable to the network’s integrity. This includes not only core smart contracts but also the underlying systems software and cryptographic code that form the bedrock of Ethereum’s decentralized architecture. The successful identification and remediation of a bug in libp2p, a foundational component for Ethereum’s peer-to-peer networking layer, serves as a tangible testament to the effectiveness of this AI-assisted auditing process.

Organizing the AI "Fleet" for Maximum Impact

A cornerstone of the Ethereum Foundation’s success lies in its systematic approach to organizing AI agents. Instead of a centralized command structure, the agents are designed to operate in parallel, coordinating their efforts through the code repository itself. This distributed model leverages version control for shared state, eliminating the need for a central process to manage and allocate tasks.

This decentralized coordination mechanism was inspired by Anthropic’s pioneering work in building a C compiler using a fleet of AI agents. By allowing agents to record their claims within the repository, perform their assigned work, and then commit their findings, the system fosters a self-organizing and resilient framework. This approach minimizes single points of failure and streamlines maintenance, allowing the human security team to focus on higher-level analysis and validation.

The process observed by the Ethereum Foundation and documented in their advisory follows a structured pipeline, mirroring stages identified by other industry leaders like Cloudflare. This pipeline typically includes:

• Reconnaissance: Initial exploration of the target codebase to understand its structure and identify potential areas of interest.
• Parallel Hunting: Multiple AI agents independently search for vulnerabilities within the codebase.
• Independent Validation: Each potential finding is subjected to rigorous verification.
• Deduplication: Mechanisms are in place to identify and eliminate duplicate reports.
• Reporting: Confirmed findings are formally documented.

Defining a "Finding": The Rigorous Triage Process

The true challenge, as highlighted by the Ethereum Foundation, lies not in generating candidate bugs but in rigorously vetting them. A candidate is only considered a genuine "finding" after it successfully navigates a stringent set of criteria. This ensures that the output is not only technically accurate but also relevant and actionable.

A candidate finding must clearly define:

• Target: The specific component and entry point within the system that an attacker could realistically exploit. This ensures the vulnerability is not purely theoretical but has practical implications.
• Invariant: The fundamental property or rule that must remain true for the system to operate correctly. The AI’s task is to identify how this invariant might be violated.
• Mechanism: The precise method or sequence of actions through which the invariant could be broken. This requires a detailed understanding of the code’s logic and potential weaknesses.
• Success: An observable and verifiable proof of the exploit. This could manifest as a program crash (panic), system stall, or the acceptance of invalid input by the system.
• Reproducer: A self-contained artifact, such as code or a configuration file, that allows the failure to be replicated reliably against the actual target code. This is paramount for verification.
• Dedup: A unique identifier or key associated with the finding, preventing multiple agents from pursuing the same vulnerability and ensuring efficient use of resources.

This structured approach forces AI agents to move beyond vague assertions of risk and instead formulate specific, testable claims. The requirement for an observable proof ensures that the identified issue has a tangible impact, making it easier for human analysts to assess its severity and prioritize remediation efforts.

The Paramount Importance of Reproducibility

Central to the integrity of AI-generated security findings is the principle that "reproducible or it didn’t happen." A candidate finding is only elevated to the status of a confirmed vulnerability when a self-contained artifact exists that reliably reproduces the failure in the live code. This reproducer must function independently of the AI’s internal logic or the subjective confidence of its generated report.

The reproducer serves as an objective arbiter. It bypasses the AI’s narrative and presents irrefutable evidence: the system either breaks as described, or it does not. This rigorous validation process is critical for filtering out a significant number of false positives that commonly arise in AI-driven security assessments. The Ethereum Foundation identifies three recurring types of false positives that highlight the necessity of this stringent verification:

• The "Looks Like" Bug: An AI might identify a pattern in the code that resembles a known vulnerability, but upon closer inspection, the specific context or implementation details render it non-exploitable.
• The "Too Simple" Bug: The AI may propose a fix for a condition that is already handled by existing error-checking mechanisms or is logically impossible to reach under normal operating conditions.
• The "Out of Scope" Bug: The AI might flag an issue within a component or a configuration that is not part of the intended operational environment or is outside the security team’s purview.

The sheer volume of potential findings generated by AI necessitates automated checks for reproducibility. Relying on the AI to self-correct or to accurately distinguish genuine issues from superficial ones is a recipe for disaster, akin to a poorly designed automated test that passes because it fails to execute the critical assertion.

The Signal-to-Noise Ratio: Triage as the Real Bottleneck

The consensus among researchers and practitioners is that the primary challenge in AI-driven security auditing is not bug generation, but the efficient and accurate triage of the generated candidates. The vast majority of AI-produced reports are often incorrect, redundant, or fall outside the defined scope of the audit.

Every candidate that progresses beyond the initial stages undergoes at least two independent checks:

1. Reachability Assessment: Can a real-world attacker realistically exploit this vulnerability in a standard network configuration? This involves evaluating the feasibility of triggering the bug without requiring extraordinary access or resources.
2. Cost-Benefit Analysis: What is the attacker’s cost to exploit this vulnerability, and what is the network’s cost if it is exploited? A bug that can be triggered by any single peer carries a different risk profile than one requiring significant computational power or specialized access.

Furthermore, all findings are cross-referenced against a continuously updated list of known, fixed, or previously rejected vulnerabilities. This prevents the AI from repeatedly identifying and reporting issues that have already been addressed, a common pitfall in automated systems.

The acceptance rate of candidates varies significantly depending on the target codebase. Auditing mature, heavily scrutinized code often results in a very low acceptance rate, which is itself a valuable outcome. A finding of "we searched extensively and found nothing" can provide a high degree of confidence in the code’s current security posture. Conversely, targeting less explored or formally verified code might yield a higher rate of genuine findings, especially in areas where machine-checked proofs cover abstract models but the deployed bytecode might deviate.

This observation aligns with the findings of other prominent security research groups. Cloudflare’s experience has shown that a narrowly focused audit is more effective than broad, undirected scanning. Anthropic’s property-based testing agent, while generating a large number of candidate reports, relied on sophisticated ranking and expert review to identify a smaller set of high-confidence findings. The generation phase, while impressive, is consistently overshadowed by the meticulous process of validation and triage.

AI’s Strengths and Weaknesses in Security Auditing

A clear understanding of what AI agents excel at and where they falter is crucial for their effective deployment. The Ethereum Foundation has outlined a "jagged frontier" of AI capabilities in cybersecurity, acknowledging that a model that performs exceptionally well in one area may struggle in another.

The final point is particularly critical. While AI agents are adept at one-shot reasoning and identifying immediate violations, they often struggle with complex vulnerabilities that emerge from a sequence of seemingly benign operations. In such cases, the AI is better utilized as a tool to suggest potentially exploitable sequences, which are then fed into a stateful test harness for deeper analysis. Using AI as a direct replacement for such harnesses risks overlooking the most insidious and costly types of bugs – those that only manifest through intricate, multi-step interactions.

Maintaining Integrity: Essential Practices for Trustworthy Audits

The trustworthiness of AI-generated security findings hinges on a few fundamental, albeit non-trivial, practices. These habits, honed through experience, ensure that the insights derived from AI are reliable and actionable:

• Reproducible Failures: As emphasized, any reported vulnerability must be accompanied by a verifiable method to reproduce the failure. This is the bedrock of validation.
• Human-in-the-Loop Triage: While AI can generate candidates at scale, human expertise remains indispensable for nuanced judgment, context assessment, and strategic prioritization.
• Comprehensive Oracle: Maintaining a dynamic and accurate list of known issues, past findings, and their resolutions is vital to prevent redundant investigations and ensure continuous learning.
• Clear Scope Definition: AI agents perform best when their operational scope is clearly defined, preventing them from wasting resources on irrelevant components or configurations.
• Independent Verification: Multiple agents or human analysts should independently verify findings to mitigate bias and confirm accuracy.
• Disclosure Policy: A robust and well-defined process for disclosing vulnerabilities is essential for responsible security practices.

The Bottleneck Shifts, Not Disappears

The advent of sophisticated AI agents in security auditing has not rendered human security researchers obsolete. Instead, it has fundamentally shifted the bottleneck. The time and effort previously dedicated to manually formulating hypotheses and exhaustively chasing down potential leads are now redirected towards the critical tasks of evaluating these hypotheses at scale. This includes the development of sophisticated "oracles" for checking known issues, running comprehensive triage processes, and managing the complexities of vulnerability disclosure.

The bottleneck has moved from the discovery phase to the validation and trust-building phase. This is arguably a more productive location for this bottleneck, as it aligns with where human judgment and critical thinking are most valuable. However, it remains a significant bottleneck, and overlooking its importance can lead to the deployment of systems with a false sense of security.

The practices that enable trustworthy AI-driven audits—reproducible failures, robust oracles, and meticulous triage—are not novel. They are the same principles that have elevated traditional fuzzing techniques from experimental research topics to standard industry practice over the past fifteen years. The tools may be new and rapidly evolving, but the underlying principles of sound security engineering remain constant.

The rapid pace of AI development presents both an opportunity and a challenge. Nicholas Carlini, a noted AI security researcher, argues that the exponential growth in AI capabilities warrants serious consideration, even while acknowledging the inherent uncertainties. If AI’s ability to generate potential vulnerabilities continues to accelerate, the corresponding human capacity for verification and judgment must advance in parallel. Failing to do so will widen the gap between the sheer volume of AI-generated claims and the actual verified security of our systems.

For the critical infrastructure upon which Ethereum relies, this dynamic is of paramount importance. AI agents enable coverage of vastly larger codebases than human teams could manage manually. In return, they demand a more rigorous and scaled approach to human judgment, applied to an ever-increasing array of sophisticated, AI-generated claims. This trade-off is highly beneficial, provided that the critical role of human judgment in verifying these claims is consistently recognized and prioritized. The ultimate product of this new paradigm is not merely the identification of bugs, but the robust assurance of system integrity through careful and discerning validation.