clet.xyz

The Ethereum Foundation’s Protocol Security team has embarked on a novel approach to fortify the network’s foundational code, employing coordinated Artificial Intelligence (AI) agents to probe critical systems. This initiative, detailed in a recent internal report, has yielded tangible results, including the identification and public disclosure of a significant vulnerability in libp2p’s gossipsub, a core component of Ethereum’s peer-to-peer communication layer. The bug, now publicly documented as CVE-2026-34219, highlights the efficacy of AI-driven security audits.

The surprise, however, was not the discovery of bugs itself, but rather the disproportionate effort required in distinguishing genuine vulnerabilities from false positives generated by the AI agents. This revelation underscores a critical challenge in the burgeoning field of AI-assisted cybersecurity: the signal-to-noise ratio. The team’s experience offers valuable lessons for client teams and security researchers aiming to implement similar AI-driven security testing methodologies.

A New Frontier in Protocol Auditing

The Ethereum Foundation’s foray into AI-driven security testing aligns with a broader industry trend. Leading organizations are increasingly exploring the potential of AI for identifying software vulnerabilities. Anthropic’s Frontier Red Team, for instance, has developed AI agents capable of generating property-based tests that have successfully uncovered bugs across the Python ecosystem. Similarly, Cloudflare has deployed frontier models within a security research framework to scrutinize its own systems. The common thread among these initiatives is a cyclical process: deploy a sophisticated AI model to analyze a codebase, allow it to search for potential weaknesses, and then meticulously triage the findings. The central question for all these efforts is how to manage the deluge of AI-generated output without being overwhelmed by confident yet inaccurate claims.

The current article focuses on the methodologies that have proven persistent, rather than the rapidly evolving tooling. Disclosure practices, a critical aspect of security vulnerability management, are noted as a separate topic deserving dedicated exploration in future publications.

The AI Agent as a Sophisticated Search Tool

In essence, an AI agent directed at a codebase functions as an advanced search tool, akin to a traditional fuzzer. However, the nature of the output distinguishes AI agents significantly. While a fuzzer typically presents a crash and a stack trace, an AI agent delivers a more comprehensive report. This includes a detailed write-up encompassing the call chain, an assessment of the claimed impact, a suggested severity level, and crucially, the artifacts necessary to reproduce the issue. The inclusion of a reproducible proof-of-concept (PoC) is paramount, offering a tangible and verifiable demonstration of the vulnerability.

The emphasis, therefore, shifts from the sheer volume of candidate findings generated by an agent to the rigorous validation of each claim. The true measure of success lies in the number of AI-generated candidates that are confirmed as genuine security flaws.

Organizing the AI-Driven Security Audit Workflow

To maximize efficiency and minimize single points of failure, the Ethereum Foundation’s Protocol Security team employs a decentralized coordination strategy for its AI agents. Multiple agents are run in parallel against a single target codebase. Their coordination is managed directly through the code repository itself, leveraging version control for shared state and eliminating the need for a centralized management process. An agent, upon identifying a potential vulnerability, documents its claim within the repository for other agents to observe, proceeds with its investigation, and then commits its findings.

This distributed approach draws inspiration from Anthropic’s methodology for building a C compiler using a fleet of AI agents, which also relies on repository-level coordination. This architecture inherently reduces the complexity of building and maintaining central control systems and minimizes potential points of failure.

The workflow, refined through iterative testing and observation, can be broadly categorized into several key stages, mirroring the process described by Cloudflare in their own security research efforts:

• Reconnaissance: Initial analysis of the target codebase to understand its architecture and identify potential attack surfaces.
• Parallel Hunting: Multiple AI agents concurrently explore different parts of the codebase, searching for vulnerabilities.
• Independent Validation: Each identified candidate vulnerability undergoes a rigorous, independent verification process.
• Deduplication: A system is in place to identify and merge duplicate findings, preventing redundant efforts.
• Reporting: Comprehensive documentation of confirmed vulnerabilities, including their impact and reproduction steps.

The Rigorous Criteria for a Confirmed Finding

For a candidate vulnerability identified by an AI agent to be considered a genuine finding, it must meet a stringent set of criteria. This structured approach ensures that only well-substantiated vulnerabilities are advanced, thereby maintaining the integrity of the security audit process. The core components of a validated finding include:

• Target: The specific component and entry point within the codebase that an attacker can realistically access under normal operating conditions. This ensures the vulnerability is not theoretical but practically exploitable.
• Invariant: A fundamental property or condition that must hold true within the system. The identified vulnerability represents a violation of this invariant.
• Mechanism: The precise method or sequence of actions through which the invariant is broken. This requires a clear understanding of the exploit path.
• Success: An observable and verifiable proof of the exploit. This could manifest as a program crash (panic), a system stall, or the acceptance of invalid input that compromises system integrity.
• Reproducer: A self-contained artifact, such as a script or a minimal code snippet, that reliably triggers the identified vulnerability when executed against the actual target code. This is the cornerstone of validation.
• Dedup Key: A unique identifier associated with the vulnerability to prevent other agents from independently chasing the same issue. This streamlines the overall process and avoids wasted effort.

This structured schema is not merely a formality; it enforces the articulation of specific, testable claims and establishes a clear definition of "done." By requiring an agent to document an observable proof, the process inherently discourages vague or subjective assessments like "this looks risky," pushing instead for concrete evidence.

Reproducibility: The Ultimate Arbiter

The cardinal rule in AI-driven security auditing, as emphasized by the Ethereum Foundation team, is "Reproducible or it didn’t happen." A candidate vulnerability holds no weight as a confirmed finding until a self-contained artifact can reliably reproduce the failure in the live code. This reproducer must function for individuals who did not author it, ensuring objectivity and verifiability.

The reproducer acts as an impartial judge, independent of the AI’s confidence level or the narrative presented in its write-up. It either executes successfully, confirming the vulnerability, or it fails, indicating a false positive. This strict adherence to reproducibility is crucial for mitigating the inherent tendency of AI agents to generate misleading results.

The team has identified three common categories of false positives that frequently emerge:

• Call chains that appear reachable but are not: The AI may construct a plausible sequence of function calls that, in reality, cannot be triggered due to program logic or access controls.
• Gaming the success check: The AI might identify a condition that superficially appears to meet the success criteria but does not represent a genuine security compromise. This is akin to a test passing because it doesn’t actually test the intended functionality.
• Inflated severity claims: The AI might overstate the impact or exploitability of a vulnerability to align with a dramatic write-up, rather than reflecting its actual risk.

These issues are not unique to AI. They echo the challenges faced in traditional software testing, where the volume of AI-generated candidates amplifies the need for automated and rigorous validation. Relying on the AI agent to self-correct is unreliable; therefore, robust, automated checks are essential.

Navigating the Signal-to-Noise Ratio: The Core Challenge

The reality of AI-driven security auditing is that the vast majority of candidate findings are erroneous. They may be duplicates, out of scope for the audit, or simply incorrect. This high rate of false positives is not a flaw in the methodology itself but rather a characteristic of how AI operates in this domain. The primary objective is to efficiently filter out these incorrect candidates while providing irrefutable proof for genuine vulnerabilities.

Each candidate that passes the initial screening undergoes two independent verification checks. The first assesses whether a real-world attacker could practically exploit the vulnerability in a standard configuration. The second evaluates the cost-benefit analysis for both the attacker and the network. A bug exploitable by any single peer carries a different risk profile than one requiring specialized access or substantial resources.

A continuously updated registry of known issues, including previously identified, fixed, or rejected vulnerabilities, is indispensable. This prevents AI agents from repeatedly flagging issues that have already been addressed.

The acceptance rate of AI-generated candidates varies significantly across different codebases. Auditing mature, thoroughly vetted code typically results in very few surviving candidates. This outcome, while indicating a robust codebase, is itself a valuable finding: "We investigated thoroughly and found no significant vulnerabilities." Conversely, less explored code or systems with formal verification models, where machine-checked proofs are established for a model but the deployed bytecode is assumed to match, may yield a higher number of findings.

The critical takeaway, echoed by organizations like Cloudflare, is that a narrowly defined scope is more effective than broad, unfocused scanning. Anthropic’s property-based testing agent, for example, generated approximately a thousand candidate reports before a combination of ranking and expert review narrowed the focus to a select group that demonstrated an approximately 86% validation rate. The generation phase was comparatively effortless; the true labor lay in the subsequent analysis and validation.

Strengths and Limitations of AI Agents in Security Auditing

The effectiveness of AI agents in cybersecurity is characterized by distinct strengths and areas where they can be misleading. A clear understanding of these nuances is crucial for leveraging them appropriately.

The performance of AI agents is not uniform across all tasks. Research by Stanislav Fort, who has tested various models against real-world vulnerabilities, describes this phenomenon as a "jagged frontier." A model that can successfully reconstruct a full exploit chain for one codebase might struggle with basic data-flow tracing on another. This variability necessitates that each candidate finding be individually scrutinized.

A particularly critical limitation is the agent’s proficiency in single-shot reasoning versus its ability to detect vulnerabilities that emerge from a sequence of actions. For complex bugs that only manifest through a specific ordering of otherwise valid operations, the AI agent is not a substitute for a stateful test harness. Instead, its role becomes that of a suggestion engine, identifying sequences that warrant further investigation using specialized testing frameworks. When used in this supplementary capacity, AI agents prove highly effective. However, when treated as a complete solution, they risk overlooking the most insidious and costly vulnerabilities – those that arise from intricate, multi-step interactions.

Maintaining Integrity: Essential Practices for Trustworthy Findings

Several fundamental practices are essential for ensuring the trustworthiness of findings generated by AI agents. These practices, while not complex, are critical for the integrity of the audit process:

• Reproducible Proofs: As previously emphasized, every confirmed finding must be accompanied by a self-contained artifact that reliably reproduces the vulnerability.
• Clear Definitions of Success: The criteria for what constitutes a successful exploit must be unambiguously defined and consistently applied. This avoids subjective interpretations.
• Independent Verification: Each candidate finding should undergo review by at least two independent entities or processes to confirm its validity and assess its real-world impact.
• Comprehensive Known-Issues Tracking: Maintaining a detailed and up-to-date record of all previously identified and addressed vulnerabilities is crucial to prevent repetitive findings.
• Attacker Cost-Benefit Analysis: For each confirmed vulnerability, an assessment of the resources and effort required for an attacker to exploit it, relative to the potential impact on the network, is vital for accurate risk prioritization.

The Evolving Bottleneck: From Discovery to Verification

The advent of AI in security auditing has not rendered human security researchers obsolete; rather, it has shifted the focus of their work. The time previously dedicated to manually formulating hypotheses and painstakingly tracing them has been redirected towards the more complex task of evaluating a significantly larger volume of AI-generated claims at scale. This includes the development of "oracles" (validation mechanisms), the meticulous triage of findings, the management of known issues, and the intricate process of vulnerability disclosure.

The bottleneck has not disappeared; it has merely migrated. It has moved from the initial discovery phase to the critical domain of validating AI-generated results. This shift is ultimately beneficial, as it places greater emphasis on human judgment, which is indispensable for discerning truth from the confident pronouncements of AI. However, this new bottleneck demands careful management to prevent the deployment of insecure systems based on flawed AI assessments.

The practices that underpin effective AI-driven security auditing are not novel. Reproducible failure demonstrations, robust validation mechanisms, and diligent triage are the same principles that have elevated fuzzing from a research curiosity to a standard practice in software security over the past fifteen years. The tools may be new, but the underlying principles of sound security auditing remain constant.

The rapid pace of development in AI tooling presents an ongoing challenge. Nicholas Carlini, a prominent researcher known for his meticulous approach, has argued for taking the exponential growth of AI capabilities seriously, while acknowledging the inherent uncertainties. If the AI’s ability to generate potential vulnerabilities continues to accelerate exponentially, the capacity for human judgment and verification must evolve in parallel. Failure to do so will result in an ever-widening chasm between the number of claims produced and the number that can be genuinely verified, increasing the risk of overlooking critical flaws.

For the foundational systems upon which Ethereum relies, this focus on verification is paramount. AI agents offer an unprecedented ability to explore vast codebases that would be infeasible to audit manually. In return, they demand a higher degree of careful human judgment to sift through a significantly larger volume of seemingly plausible but potentially erroneous claims. This trade-off is highly advantageous, provided that the critical role of human judgment in the verification process is fully recognized and prioritized. The true product of this endeavor is not the AI’s output, but the validated security of the systems it helps to scrutinize.