Crypto: Ethereum deploys AI agents to track critical flaws in its network

The Ethereum Foundation is changing paradigm and automating its cyber defense. His cell Protocol Security » now deploys swarms of autonomous AI agents to attack its own network continuously. The objective is to track down, violate and correct vulnerabilities before hackers. This initiative, revealed by the protocol’s security team, marks a major technological breakthrough at a time when the slightest flaw in a smart contract can result in the loss of hundreds of millions of dollars.

A first concrete victory against network flaws

The preventive offensive led by the Ethereum Foundation immediately proved its effectiveness by uncovering a critical vulnerability at the very heart of the software on which the blockchain depends, while quantum resistance becomes a priority. The researchers confirmed they orchestrated simulated direct attacks against their own infrastructure, an offensive method known as “red teaming”. In their official report, they share their first results, highlighting the following key elements:

• Targeting vital infrastructure: “We launched coordinated AI agents against the types of systems the network depends on, such as system software, cryptographic code, and contracts that must be impeccable” ;
• The discovery of real flaws: scientists add without the slightest ambiguity that “agents found real bugs”usable in production code;
• Neutralization of a major bug: an anomaly has been located in the protocol “libp2p gossipsub”which represents the peer-to-peer network layer used by Ethereum’s consensus clients. This bug made it possible to remotely trigger a panic error threatening the stability of the nodes. The flaw has been fixed and listed on GitHub under the official reference CVE-2026-34219.

Beyond simple detection, this experiment revealed a technical reality unexpected for human engineers. Indeed, the use of large language models for software security changes the very nature of audit work, shifting the effort from raw research to critical triage. Members of the Ethereum Foundation have expressed their surprise at this dynamic: “the fact that the agents found bugs was not the surprise”.

They specify that “the surprise was how little work it took to find them, and how much effort it took to distinguish real bugs from those that just seemed real”. This efficiency is also part of a general sectoral trend: last April, a preliminary version of Anthropic’s Claude Mythos model managed to identify 271 vulnerabilities in Mozilla’s Firefox browser, illustrating the computing power of these new tools.

The military organization of swarms of autonomous AI agents

To achieve this level of precision, the Ethereum Foundation has implemented a rigorous methodological architecture by distributing its AI agents within a hyper-specific role structure. The organization of these swarms is based on four distinct and complementary functions: recognition, hunting for flaws, filling gaps and finally validation.

While one group of agents maps potential attack vectors, another works to reproduce outages to test the viability of exploits directly against production code. The researchers emphasize the importance of this strict framework: “the pattern is there for a reason”.

According to them, “it imposes a specific and verifiable statement as well as a clear definition of the work accomplished. An agent who must write an observable proof cannot fall back on a simple It seems risky”. This rigor eliminates the artistic blur typical of traditional automated reports.

The challenge of validation in the face of machine illusions

The proliferation of these detailed reports poses a significant challenge for security teams, because the technical eloquence of a machine does not guarantee its veracity. Unlike traditional automated testing tools named “fuzzers”which simply inject random data to crash a program, AI agents write complex impact analyzes and create proof-of-concept scenarios.

The other side of the coin is the proliferation of convincing false positives. To counter this hallucination phenomenon, the Foundation has established an absolute validation protocol. The researchers remind an immutable golden rule: “one rule matters more than all the others. A candidate is not a breakthrough until there is a self-contained artifact that replicates the failure against real code, and runs for someone who didn’t write it.”. They conclude pragmatically: “the reproducer does not read the report, and he does not care about the level of confidence displayed by the model. Either it executes or it doesn’t execute.”.

This transition to AI-assisted audits outlines a new era for Web3. Recent history shows that this approach is successful on a global scale. Last May, researcher Taylor Hornby used Claude Opus 4.8 to detect a critical vulnerability within Zcash’s Orchard privacy pool. This flaw, which had been dormant for around four years, could have allowed the creation of fake ZEC tokens without leaving a trace.

By internalizing these technologies, the Ethereum Foundation accepts a new operational paradigm. As its experts summarize: “AI has not replaced the security researcher. She moved the work”. Access to these swarms offers unprecedented code coverage, but in return requires increased human acuity.

The researchers conclude: “Agents allow us to cover much more ground than we could by hand. In return, they demand more careful judgment, in the face of a much larger pile of confident assertions. It’s a worthwhile process, as long as you remember that judgment is the real product.”. In the future, the resilience of blockchains will depend on the human ability to mediate machine diagnostics.