Ethereum Foundation Deploys AI Agents to Find Real Bugs

The Ethereum Foundation has revealed that its ongoing experiments with coordinated artificial intelligence agents have successfully identified real vulnerabilities in the network's critical infrastructure, but the organization says the primary challenge has shifted from finding potential bugs to verifying which reports are genuine. The findings, detailed in a technical post on Thursday, July 9, highlight both the promise and the limitations of AI-assisted security research.

One confirmed discovery involved a remotely triggerable panic in the gossipsub component of libp2p, a peer-to-peer networking layer used by Ethereum consensus clients. The vulnerability was subsequently fixed and disclosed as CVE-2026-34219. According to the Foundation, no funds or user data were compromised.

The Foundation's Protocol Security team reported that while AI agents can effectively inspect source code, trace execution paths, and generate proof-of-concept material, a significant portion of their output consists of false positives. These include reports based on unreachable code, duplicate known issues, debug-only crashes, or weak formal proofs that fail to demonstrate a real security problem. The...