Ethereum Foundation unleashes AI red team, lets bots crack the chain first 🛡️

The Ethereum Foundation said Thursday it has been running coordinated AI agents against the software underpinning Ethereum, targeting systems code, cryptographic libraries and smart contracts as part of an internal red-teaming effort by its Protocol Security team. "We've been running coordinated AI agents against the kinds of systems the network depends on, like systems software, cryptographic code, and contracts that have to be right," the researchers wrote in a blog post. "The agents found real bugs."

Among the findings was a remotely triggered panic in libp2p's gossipsub, part of the peer-to-peer layer used by Ethereum consensus clients. The issue was fixed and disclosed on GitHub as CVE-2026-34219.

The team said AI agents were organized into specialized roles including reconnaissance, hunting, gap-filling and validation, with some searching for attack paths and others attempting to reproduce failures against production code. "Agents finding bugs wasn't the surprise," the team wrote. "The surprise was how little of the work went into finding them, and how much went into telling the real bugs from the ones that just looked real." The researchers also stressed the importance of structured schemas: "The schema is there for a reason. It forces a specific, testable claim and a clear definition of done. An agent that has to write down an observable proof can't fall back on 'this looks risky.'"

The team drew a direct comparison between AI agents and traditional fuzzers, noting that unlike fuzzers, AI agents can generate vulnerability reports, assess impact and build proof-of-concept tests, though detailed findings are not always correct. The growing role of AI in vulnerability research was demonstrated in April, when a preview version of Anthropic's Claude Mythos discovered 271 vulnerabilities in Mozilla's Firefox browser.

Separately, a new nonprofit aimed at onboarding Wall Street to Ethereum launched Wednesday. Called Ethereum Institutional, it will serve as an independent point of contact for banks, asset managers and other financial institutions seeking involvement with tokenization, stablecoins