Ethereum Foundation revealed that the greatest challenge for AI-assisted research in security is to prove which vulnerabilities reported are real, rather than find potential bugs.
You can read more about it here:
- Ethereum Foundation states that it is much harder to verify AI bug reports than to generate them.
- A real libp2p flaw was discovered by AI agents, and later reported as CVE-2026-34219.
- Human validation and reproducible evidence are still essential, according to The Foundation.
The Ethereum Foundation’s Protocol Security team said that recent experiments using coordinated AI agents revealed real software vulnerabilities across the systems on which Ethereum relies. However, the organization stated the focus is now on separating the valid from the convincing false positives.
The results were described in a blog post that explained the testing of AI agents on systems software and cryptographic libraries as well as high-assurance smart contract.
The discovery of an easily triggerable panic within the gossipsub component in libp2p (which is part of the peer to peer networking layer that Ethereum consensus clients use) was confirmed. The Ethereum Foundation confirmed that the vulnerability had been fixed, and was later published as CVE-2026-3419.
In place of AI agents being viewed as decision-makers by the Foundation, they are to be seen as tools which generate hypotheses that require independent validation. The Foundation noted that while agents are capable of inspecting source code and tracing execution paths as well as preparing proof-of concepts, they can also produce reports on issues such unreachable or duplicate code, crash-only debuggings, weak formal proofs, etc.
This team found out that AI was not able to identify the bugs. Instead, validating these reports took up far more time.
Unreliable reports are filtered by a multi-agent workflow
The Ethereum Foundation has said that it uses multiple AI agents to review the same repository of software, each one handling a specific stage in the process. In lieu of using a coordinator central, agents can exchange data by collaborating on version control.
According to Foundation’s workflow, reconnaissance begins when broad attacks surfaces are narrowed and tested into testable concepts. The hunting agents follow the hypothesis and code to try to create a reproducible. To avoid duplicating earlier work, gap-filling agents keep track of accepted and rejected reports. Validation agents examine each candidate independently, eliminate duplicates and decide whether the report is a valid vulnerability.
According to the Foundation, every report accepted must include an observable failure mechanism and a reachable goal, as well as a self contained reproducer. The requirements aim to make sure that each claim can be directly tested against the production code.
Human Validation remains the Decisive Factor
The Ethereum Foundation has said that one principle is at the core of this process: A vulnerability doesn’t count until someone else can replicate it on the actual codebase. This requirement, according to the Foundation removes any reports that are based around impossible attack pathways, failures only due to debugging, or formal results of verifications which look mathematically right but don’t prove anything meaningful about security.
The Foundation stated that candidates who survive are evaluated not only for technical validity, but also their practical exploitability. Security implications of flaws that can be exploited by anyone on a network are different than those that require privileged computing or access.
Foundation also noted AI agents’ inconsistency when it comes to assessing exploit reachability, severity of attacks, and vulnerabilities that are only discovered through a series valid interactions. It said that in these situations the agents performed better when used as assistants to stateful testing frameworks rather than replacing experienced security researchers.
It is only a few weeks since the Ethereum Foundation has completed its major restructuring. According to a statement made on June 23, the Ethereum Foundation had completed an internal restructuring. reduced its workforce by about 20%After a review of its Mandate, Treasury Management Policy and spanning several months, 54 employees left the company.
The Foundation stated that the purpose of the restructuring is to concentrate staff and resources to perform tasks only they can do, while maintaining long-term Ethereum developments.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
