Key highlights:
- The Ethereum Foundation has tested AI agents in a cybersecurity role
- The AI agents found real bugs in the shortest time possible, with the Foundation warning that security researchers are still required
- Ethereum is now bracing for its biggest network improvements since The Merge
The Ethereum Foundation has announced a raft of positives after testing the capabilities of AI agents in spotting security vulnerabilities on the Ethereum network. Despite the successes, the Ethereum Foundation disclosed that AI agents are not replacements for security researchers as the network braces for seismic changes.
Ethereum Foundation unleashes AI agents to spot vulnerabilities
According to a blog post by the research nonprofit, the experiments with coordinated AI agents for identifying network vulnerabilities recorded impressive success levels. Right off the bat, the Ethereum Foundation’s Protocol Security team disclosed that the AI agents “found real bugs.”
One of the bugs, a remotely-triggerable panic on a P2P layer for Ethereum consensus clients, has been fixed. However, researchers at the Ethereum Foundation disclosed that finding bugs with AI agents did not come as a surprise.
“The real surprise was how little of the work went into finding them, and how much went into telling the real bugs from the ones that just looked real,” read the blog post.
Armed with the stellar result, the team disclosed a blueprint for client teams on Ethereum keen on using AI agents to spot network vulnerabilities. Right off the bat, the EF Protocol Security Team divided the AI agents into four categories, including reconnaissance, hunting, gap-filling, and validation.
The team clarified that it did not invent the methodology but borrowed from previous studies by Anthropic and Cloudflare. Previously, Ethereum’s UTXO proposal drew plagiarism jabs from Cardano founder Charles Hoskinson.
Despite the positives, the researchers warned that AI agents are misleading in several areas, including “call chains that look reachable but aren’t.” Per the study, AI agents are also likely to inflate the severity of a bug to “match how dramatic the write-up sounds.”
Source: Ethereum Foundation
On the flipside, AI agents excel in suggesting a root cause for a bug and reading the spec and code together. In their final submission, the Ethereum Foundation noted that AI agents are not a replacement for the security researcher.
“Agents let us cover far more ground than we could by hand,” read the post. “In exchange, they ask for more careful judgment, across a much bigger pile of confident-sounding claims.”
Ethereum Foundation focuses on core protocol defences
In June, the Ethereum Foundation disclosed plans to decentralize its responsibilities and focus on core protocol defenses. The new priorities include advancing the base layer, hardening cryptographic guarantees, and handling security fixes.
Furthermore, the research nonprofit adopted a leaner stance, eliminating 20% of its staff strength and cutting its annual budget by nearly half. Recently, the Ethereum Foundation announced the shutdown of the Protocol Support team, continuing a streak of sunsetting key units of the nonprofit.
Amid the cuts, new research organizations, Ethlabs and Ethereum Institutional, have emerged to provide advanced research capabilities for the network.
Zooming out, plans for a Lean Ethereum are underway with Vitalik Buterin forecasting four years for the changes to take place. The changes, tipped to be the next major iteration of Ethereum after the Merge, will affect every component of the network, introducing quantum-proof capabilities and improving network speed and resilience.