Ethereum Foundation: AI agents can find real vulnerabilities, but most are false positives

CoinFeed July 10 news, according to The Block, the Ethereum Foundation published a blog stating that AI agents perform well in finding network infrastructure vulnerabilities, but most results are false positives. Its protocol security team used coordinated AI agents to test critical network infrastructure (including system software, crypto code, and smart contracts), and has found real vulnerabilities, including a remotely triggerable panic issue in libp2p gossipsub, which has been fixed and publicly disclosed. However, AI agents also create greater workload for human researchers — most candidate vulnerabilities are wrong, duplicate, or out of scope. A potential vulnerability is only considered a real discovery when researchers can independently reproduce it against the actual code. The foundation stated, 'The bottleneck has not disappeared, it has just shifted from finding vulnerabilities to verifying results, and that is where human judgment really comes into play.'