Preface

Context: Ethereum Foundation engineers deployed AI agents to search for software faults in the network’s gossipsub messaging layer. The goal was to strengthen the protocol by finding vulnerabilities before attackers could exploit them. The experiment produced a noteworthy result: an AI-aided discovery of a crash vulnerability that could take validator nodes offline. That flaw has since been patched and disclosed as CVE-2026-34219. However, the project highlighted a key lesson — AI can rapidly propose plausible bugs, but humans remain essential to verify whether those reports describe real, exploitable problems.

Lazy bag

Summary: Engineers used AI agents to fuzz and analyze the gossipsub system, which led to a valid crash bug that could take validators offline. But most AI findings were misleading or false positives: test-only crashes, attacks that depended on impossible preconditions, or trivial formal proofs. As a result, the Foundation now uses agents to suggest suspicious sequences while still relying on conventional testing and human review to confirm real vulnerabilities.

Main Body

The Ethereum Foundation ran an experiment to combine AI reasoning with traditional security workflows in an effort to find bugs in the software that underpins the Ethereum network. Ethereum is operated by thousands of nodes that exchange messages and maintain the blockchain; validator nodes depend on reliable message delivery to participate in consensus. The Foundation focused on gossipsub, a messaging subsystem that helps propagate information across the network. A problem in that layer can cause nodes to crash, and if validators crash and remain offline, the network’s resilience and security could be affected.

During the exercise, AI agents produced a number of findings, including a crash scenario that allowed a remote peer to trigger a shutdown of a node — effectively taking a validator offline until an operator intervened. That issue was promptly fixed and publicly recorded as CVE-2026-34219, with credit to the team. The discovery demonstrated AI’s potential to surface meaningful defects quickly. Yet the most revealing outcome of the experiment was not that AI found bugs, but how much effort was required to separate genuine vulnerabilities from convincingly written but incorrect reports.

Traditional fuzzers work in a relatively straightforward way: feed malformed or unexpected inputs into software until something breaks, then report the crash and the execution trace. An engineer can often reproduce and assess such crashes in minutes. AI agents, by contrast, produce elaborate narratives: they outline an attack path, explain why the issue matters, rate its severity, and often include exploit-like code or proof-of-concept snippets. The prose reads smoothly whether the underlying report is accurate or not, which can mislead reviewers into investing time in problems that are not exploitable in practice.

The Foundation documented three recurring classes of false positive that complicated triage. First, some crashes occurred only in test builds where additional safety checks are compiled in. Those checks can intentionally trigger failures to catch bugs during development, but they are absent from production builds, so real-world users are not affected. Second, some reported attacks assumed that an attacker could directly insert a dangerous or malformed value into the program; in reality, every externally reachable path that could deliver that value filters or rejects it, so the attack could not be mounted by a remote adversary. Third, formal-verification artifacts sometimes passed trivial proofs that proved an uninteresting or vacuous property rather than shedding light on meaningful program behavior. In every instance, the agents generated concise, confident explanations that masked the tests’ lack of practical relevance.

These recurring false positives point to a core limitation of current AI approaches: they are excellent at describing a single problematic state or moment but struggle when the vulnerability arises from a complex sequence of individually valid steps. Many high-profile crypto exploits follow precisely that pattern — each step is legitimate, but when arranged in a particular order the sequence produces an attack. Recent incidents, such as the Edel Finance and BONK governance incidents, exploited sequences where normal operations (price wrapping, token buying, voting, execution) were arranged to produce an illicit outcome. Agents that reason locally about single states can miss the subtle contextual dependencies that make these multi-step sequences dangerous.

Given those limitations, the Ethereum Foundation has adopted a hybrid process. Agents are used to propose suspicious sequences and scenarios to investigate, which speeds up hypothesis generation and broadens the search space. But every agent-suggested finding is then verified through established testing tools, manual review, and careful reasoning by experienced engineers. The agents act as powerful assistants that can surface novel ideas and patterns, but human judgment remains the final arbiter of whether a report describes a real, exploitable vulnerability.

The broader takeaway for the blockchain and software-security communities is practical: AI can accelerate discovery and provide helpful suggestions, but it cannot replace domain expertise. Teams should expect a large fraction of AI-generated reports to be false positives and should design workflows that quickly filter and confirm findings. Useful practices include running agent-proposed inputs through existing fuzzers and test harnesses, checking whether a crash reproduces in production builds, verifying the feasibility of attacker-controlled inputs, and critically reviewing formal proofs for meaningful properties rather than syntactic validity.

By publishing their field notes, the Foundation aimed to equip other projects with guidance for integrating AI into security workflows responsibly. The experiment demonstrates a promising path forward: use AI to expand coverage and propose novel hypotheses, but maintain rigorous human-led validation to ensure the network’s safety. In the case of gossipsub, that balance led to a real, fixed vulnerability and reinforced the discipline required to vet AI’s output effectively.

Key Insights Table