Ethereum Foundation Says AI Finds Real Bugs, But Most Leads Are False Alarms

The Ethereum Foundation says AI agents are proving useful for spotting security flaws across the network’s infrastructure, but the bulk of what they flag turns out to be false positives. In a blog post published Thursday, the foundation explained that finding bugs was never the hard part. The real challenge has been separating genuine threats from findings that only appear real at first glance.

Real Vulnerabilities Confirmed

The foundation’s Protocol Security team has been running coordinated AI agents against systems software, cryptographic code and smart contracts. One confirmed discovery was a remotely triggerable crash in libp2p’s gossipsub, a key part of the peer-to-peer layer used by Ethereum’s consensus clients. That issue has since been fixed and publicly disclosed.

Human Review Still Essential

According to the foundation, most flagged candidates are incorrect, duplicated or outside the scope of what researchers are looking for. A vulnerability is only confirmed once researchers can independently reproduce the failure in the actual code. The foundation noted that AI tools still struggle to catch issues that only appear across a sequence of actions rather than a single point of failure.

Shift in Where Human Effort Goes

Researchers say the workload hasn’t disappeared, it has simply moved from searching for bugs to verifying and trusting the results AI produces. This development follows the foundation’s recent restructuring, which included a reduction of 20% of its workforce.