The Protocol Security team from the Ethereum Foundation (EF) conducted a large-scale experiment, directing coordinated AI agents at critical components of the blockchain infrastructure. The targets included system software, cryptographic code, and smart contracts. The results were unexpected: the key issue turned out to be not bug detection, but their verification.
Using multiple specialized AI systems operating in parallel against a single repository allowed for workload distribution. Some agents were responsible for initial code reconnaissance, while others handled searching for potential vulnerabilities, filling gaps, and validation. Coordination was carried out through a shared repository and a version control system.
As noted by the EF, the agents do find bugs, but the real surprise is the minimal cost of finding them compared to the titanic effort of separating real vulnerabilities from false positives. Researchers emphasize that AI has not replaced humans, but merely shifted the "bottleneck": instead of forming hypotheses, specialists now spend time triaging a vast array of generated candidates.
Practical Results
A publicly disclosed example is the CVE-2026-34219 vulnerability in the Rust implementation of libp2p gossipsub. An error in backoff expiry handling allowed remote process termination when processing a specially crafted PRUNE message with an almost maximum backoff value. The cause was unchecked arithmetic when adding Instant + Duration, leading to overflow.
However, most candidates found by the AI agents turned out to be false positives, duplicates, or issues outside the scope of testing. The EF considers this not a failure, but a normal part of the methodology. Agents perform worse with vulnerabilities that only manifest through a long chain of correct actions — such logic requires not only finding a suspicious fragment but also proving the reachability of the entire sequence of states.
Reorganization Context
The publication coincides with a major restructuring of the foundation. In June, the EF cut its staff by 20%, introduced an updated governance structure, and co-founder Vitalik Buterin announced a budget reduction of approximately 40% as part of a transition to a long-term capital management model. The disbanding of the Protocol Support team, which handled protocol development coordination, network update tracking, and EIP support, further signals a shift in priorities.
Expert Opinion: The EF experiment demonstrates that AI agents are becoming a powerful tool for initial code screening but do not eliminate the need for deep human analysis. Amid budget cuts and reorganization, this approach could become key to maintaining Ethereum's security, but it requires a fundamentally new infrastructure for triage. The market is still underestimating how much the paradigm of security auditing in blockchains is changing.