Notes from the Ethereum Basis’s Protocol Safety crew on operating coordinated AI brokers towards actual protocol code, together with how we manage the work, what holds up below scrutiny, and what consumer groups and safety researchers can take from it. This publish stands by itself; later posts will go deeper on particular person purchasers.
What we have been operating, and what stunned us
On the Ethereum Basis’s Protocol Safety crew, we have been operating coordinated AI brokers towards the sorts of techniques the community relies on, like techniques software program, cryptographic code, and contracts that must be proper. The brokers discovered actual bugs. One is now public: a remotely-triggerable panic in libp2p’s gossipsub, a core a part of the peer-to-peer layer Ethereum consensus purchasers run on, fastened and disclosed as CVE-2026-34219 with credit score to the crew.
Brokers discovering bugs wasn’t the shock. The shock was how little of the work went into discovering them, and the way a lot went into telling the true bugs from those that simply regarded actual.
This publish is for consumer groups and safety researchers who wish to do the identical factor. It covers how we manage the brokers, the bar a candidate has to clear earlier than it counts as a discovering, and the habits that preserve the outcomes reliable.
Groups elsewhere are converging on the identical recipe. Anthropic’s Frontier Crimson Workforce constructed an agent that writes property-based exams and located actual bugs throughout the Python ecosystem. Cloudflare ran a frontier mannequin via a security-research harness towards their very own techniques. Everybody lands on the identical loop: level a succesful mannequin at a codebase, let it search, and triage what comes again. So the true query is how to do that with out drowning in confident-sounding noise.
One caveat up entrance: tooling for agent-driven audits strikes quick, and any particular setup is outdated in just a few weeks. So this publish is intentionally in regards to the strategies, that are persistent, slightly than the tooling. Disclosure is its personal subject and can in all probability be its personal publish.
An agent pointed at a codebase is a search software, rather a lot like a fuzzer. The distinction is what comes again. A fuzzer fingers you a crash and a stack hint. An agent fingers you much more, together with a write-up (name chain, affect declare, recommended severity) and the artifacts to again it, like a proof-of-concept you’ll be able to run towards the true code.
All of that makes the outcome simple to learn and simple to belief, the operating proof-of-concept most of all. So do not depend what number of candidates an agent produces. Rely what number of develop into actual.
How the work is organized
We run many brokers in parallel towards one goal. They coordinate via the repository itself, with shared state in model management and no central course of handing out work. An agent writes down a declare the place the others can see it, does the work, and commits.
We bought this method from Anthropic’s writeup on constructing a C compiler with a fleet of brokers, which coordinates the identical manner. There is no central coordinator to construct or preserve, and fewer that may go flawed.
The roles are generated by the work that is found:
- Recon turns an assault floor into concrete, testable hypotheses. Not “audit the decoder” however “this area is trusted previous this level; this is the property it ought to preserve, the way in which it’d break, and the proof that will settle it.”
- Looking takes one speculation, traces the code path, and tries to construct a reproducer.
- Hole-filling seems at what was accepted and what was rejected, writes the following batch of hypotheses, and tracks protection so the brokers do not preserve going over the identical floor.
- Validation re-checks every candidate independently, removes duplicates, and decides.
We did not invent this pipeline. Cloudflare describes the identical phases, recon, parallel searching, unbiased validation, deduplication, reporting, and their writeup helped form ours.
This is what a candidate seems like earlier than it counts as a discovering:
goal: element and entry level an attacker can truly attain invariant: the property that should maintain mechanism: the precise manner it could be made to break success: observable proof: a panic, a stall, an accepted-invalid enter reproducer: a self-contained artifact that runs towards the true code dedup: a key, so two brokers do not chase the identical factor
The schema is there for a cause. It forces a selected, testable declare and a transparent definition of performed. An agent that has to put in writing down an observable proof cannot fall again on “this seems dangerous.”
Reproducible or it did not occur
One rule issues greater than some other. A candidate is not a discovering till there is a self-contained artifact that reproduces the failure towards the true code, and that runs for somebody who did not write it.
The reproducer does not learn the write-up, and it does not care how assured the mannequin sounded. It both runs or it does not.
Most of its worth is within the false positives it catches. Three of them come up time and again, and each is the agent getting a go for the flawed cause:
- A panic that solely occurs in a debug construct. Compile and run it the way in which the software program truly ships, and the worth simply wraps round. Nothing crashes. It seems like a crash, but it surely is not one.
- A reproducer that builds some inside worth by hand, one no actual enter may ever produce, as a result of each path an attacker controls rejects it earlier. The bug solely “reproduces” towards a perform that nothing reachable calls that manner.
- In formal-verification work, a proof that goes via however does not imply what you needed. The assertion is trivially true no matter what the code does, or it is weaker than the property you meant to seize. The verifier is happy, however the theorem does not constrain the conduct you truly cared about.
None of that is new. It is the identical factor as a check that passes as a result of it does not truly verify something. What’s new is the amount. An agent writes the ineffective model as quick as the true one, and simply as confidently. So the verify needs to be automated. You’ll be able to’t depend on the agent to catch itself.
Sign-to-noise is a lot of the work
Most candidates are flawed, duplicate, or out of scope. That is not an issue with the strategy; that is the way it works. The aim is to reject the flawed ones quick and again the true ones with proof that is arduous to argue with.
Each candidate that survives will get two unbiased checks. Can an actual attacker truly attain it in a traditional configuration? And what does it value the attacker to tug off, in comparison with what it prices the community if it really works? A bug that any single peer can set off may be very totally different from one which wants particular entry or an enormous quantity of sources.
The whole lot will get checked towards a operating listing of what is already identified, fastened, or rejected. With out that, the brokers preserve rediscovering the identical closed subject and reporting it time and again.
Acceptance charges range rather a lot from goal to focus on, and that variation is beneficial by itself. Run this towards mature, closely audited code and nearly nothing survives, which continues to be value realizing. “We regarded arduous and located nothing” is an actual outcome. Run it towards less-explored code, or towards formally verified code, the place a machine-checked proof covers a mannequin and the deployed bytecode is barely assumed to match it, and extra will get via.
We’re not the one ones who discovered that the triage is the arduous half. Cloudflare’s primary takeaway was {that a} slim scope beats broad scanning. Anthropic’s property-based-testing agent generated one thing like a thousand candidate reviews, then used rating and professional overview to get right down to a prime tier that held up about 86 % of the time. The era was the straightforward half. I am not going to publish our personal numbers right here; tied to a selected goal, they’d say extra in regards to the goal than in regards to the technique.
What the brokers are good at, and the place they mislead
There’s hype in each instructions, so this is a plain listing of what the brokers do effectively and the place they mislead.
| Good at | Deceptive at |
|---|---|
| Studying the spec and the code collectively | Name chains that look reachable however aren’t |
| Stating and checking an actual invariant | Gaming the success verify (a go for the flawed cause). |
| Drafting a reproducer from a one-line concept | Inflating severity to match how dramatic the write-up sounds |
| Suggesting a root trigger earlier than you have regarded | Bugs that span a sequence of legitimate steps |
The break up is not even regular from one job to the following. Stanislav Fort, testing a variety of fashions on actual vulnerabilities, calls this a jagged frontier, or a mannequin that recovers a full exploit chain on one codebase can fail fundamental data-flow tracing on one other. You’ll be able to’t assume one good outcome means the following will maintain up, which is another excuse each candidate will get checked by itself.
The final row is the vital one. A single agent session is nice at one-shot reasoning and unhealthy at bugs that span a sequence of steps, the place every step is legitimate and solely the order is flawed. For these, the agent is not the search software. Its job is to counsel which sequences are value operating via a stateful check harness. Used that manner, it really works effectively. Used as a substitute for the harness, it misses the costliest bugs there are, those that solely present up throughout a sequence.
Conserving it sincere
A number of habits do a lot of the work of creating agent findings reliable, and none of them are difficult.
- Provenance on each artifact: what produced it, with what context, towards which revision. A discovering needs to be one thing you’ll be able to re-run months later.
- Determinism the place it counts: one surroundings, one strategy to construct and run, so “reproduces” means the identical factor on each machine, not simply the one the place it was discovered.
- Norms, not scripts: inform brokers what issues, the invariants and the bar for an actual discovering, as a substitute of a numbered process. Over-scripted brokers break the identical manner over-specified exams do, they preserve following the steps after the steps cease making sense. A examine of repository context information discovered the identical factor: the additional necessities lowered job success and raised value by over 20%, and the authors advocate conserving context to the minimal necessities.
- An individual makes the ultimate name: brokers counsel. They do not determine what’s actual, what’s a reproduction of a identified subject, or what will get disclosed and when.
The bottleneck moved
AI did not change the safety researcher. It moved the work. The time that used to enter developing with and chasing down hypotheses now goes into judging them at scale, together with constructing the oracle, operating the triage, conserving the listing of identified points, and dealing with disclosure.
The bottleneck did not go away. It moved from discovering bugs to trusting the outcomes, which is a greater place for it, as a result of that is the place human judgment truly issues. But it surely’s nonetheless a bottleneck, and ignoring that’s how you find yourself delivery a flawed “it is fantastic.”
The practices that make this work aren’t new. Reproducible failures, actual oracles, and cautious triage are the identical practices that turned fuzzing from a analysis subject into customary follow over the past fifteen years. The instruments are new. The practices aren’t.
How briskly the instruments preserve altering is an open query. Nicholas Carlini, cautious and as soon as a skeptic himself, argues the exponential case is value taking critically, even whereas he retains extensive error bars on it. If the era facet climbs that quick, the judgment facet has to climb with it, or the hole between what will get produced and what truly will get verified solely widens.
For the techniques Ethereum relies on, that is the half that issues. Brokers allow us to cowl way more floor than we may by hand. In trade, they ask for extra cautious judgment, throughout a a lot greater pile of confident-sounding claims. That is a commerce value making, so long as you do not forget that the judgment is the true product.
