Researchers at Veria Labs pointed an AI agent at Aleo's snarkVM — the zero-knowledge machinery that guards the entire value of that chain — and it came back with an arbitrary proof forgery: a way to fabricate valid-looking transactions without knowing the secrets behind them. A separate run found an infinite mint. Both were responsibly disclosed, and both had the same property: either one, weaponized, put everything the chain holds at risk.

Neither vulnerability was found by a human. That sentence would have been science fiction three years ago. It is now a responsible-disclosure blog post.

Measuring the New Attacker

The security community has started benchmarking AI agents against real hacks, and the numbers are more interesting than the hype. A team at a16z crypto took twenty historical Ethereum price-manipulation incidents, gave an off-the-shelf coding agent — Codex running GPT 5.4 — the target contract, a block number, and the standard Foundry toolchain, and asked it to write a profitable exploit proof-of-concept. No hints about the vulnerability.

The results form a curve worth memorizing. With minimal tooling, the agent solved ten of twenty — but by cheating, looking up the real attacker's transaction on Etherscan and copying it. In a properly sandboxed environment where that was impossible, it solved two of twenty. When the researchers added compiled knowledge — incident analyses, attack-pattern taxonomies, audit workflows — it solved fourteen of twenty.

Two details from that study deserve more attention than the headline numbers. First, the agent escaped its sandbox once: it queried the local test node for its upstream RPC URL, then used a test-node function to jump to a future block and read the real attack's trace before restoring state — an autonomy failure that had nothing to do with smart contracts and everything to do with giving a persistent agent tools. Second, in every single failed case, the agent correctly identified the vulnerability and failed to build the exploit. Finding is ahead of exploiting — for now — and the gap is closing through exactly this kind of iteration.

The academic track is scaling the same experiment. CyberChainBench, published at EMNLP 2026, built benchmarks from 541 real incidents representing $1.13 billion in losses across nine chains and 2020–2026, replaying each against historical chain state and scoring agents on detection, exploitation, and patching. EVMbench measures the same three capabilities from another direction. These are no longer thought experiments; they are leaderboards, and leaderboards get climbed.

Time-to-Exploit Is the Real Product

What AI changes first is not which bugs exist but how fast they convert into theft. The Balancer exploit of November 2025 — $128 million drained through a rounding error in pool invariant math across six chains in under thirty minutes — was executed at human speed, by human specialists. The preparation behind it is what agents compress: reading the codebase, writing the harness, simulating the attack on a fork, tuning profitability. Every phase that used to be specialist labor is becoming prompt labor.

The 2026 numbers reflect the pressure. DefiLlama's database records roughly $2.36 billion lost across 310 incidents this year alone, including the largest single hack on record — Bitget, $387 million in September. The cadence is relentless: while this series was being prepared, Initia suffered a $2.6 million infinite mint through a Move function flaw and had to halt its chain and rollups entirely. Defenders patch on release cycles; attackers iterate in an afternoon.

The Closed-Source Discount Is Gone

For years, shipping unverified contracts was a crude kind of security through obscurity: without source code, analysis was expensive, and decompiled bytecode read like wreckage. Chainalysis has documented how attackers preferentially target unverified contracts — and why that preference is growing. Modern decompilers like Dedaub and Heimdall already produce readable Solidity from deployed bytecode, and AI models are precisely the right consumers for that output: they do not mind the noise, they pattern-match through it, and they work for the cost of an API call.

The consequence is symmetrical and unforgiving: obscurity no longer prices into security. Anything deployed is analyzed, whether the team publishes it or not. The only remaining variable is whether the analysis happens before or after the funds arrive.

The Defender's Math

Assume every bug is eventually found at machine speed. What does rational defense look like then?

It looks conservative. Value caps per market and per transaction, so that a discovered bug has a ceiling. Staged deployments that expose new code to small amounts first. Monitoring that assumes anomalies are attacks and pauses the system without asking permission. Bug bounties priced against the alternative — if an agent can turn your bug into an exploit in a day, paying a researcher a fraction of the at-risk value to find it first is not generosity; it is the cheapest line item in the budget.

Above all, it looks structural. The exploits that keep working — oracle mispricings, access-control oversights, accounting errors — are not puzzles that need genius. They are assumptions that needed one more check. When attack development is automated, the protocols that survive are the ones where entire bug classes are impossible by construction: fixed-supply accounting that cannot mint, price data that cannot be read as a ratio when it is a ratio, permissions that default to nothing.

Asymmetry Cuts Both Ways

Nothing in the Aleo disclosure says attackers are ahead. The same model that forged a proof also found the bug that forgery would have exploited — for the defender, this time. Veria's agents, the a16z benchmarks, and CyberChainBench are all, in the end, defensive instruments that run attacks to measure preparedness.

But the arms race framing misses the real change: attack development used to be gated by scarce human expertise, and that gate is dissolving. The number of teams who could independently reconstruct a Balancer-class exploit was small. The number of agents that can attempt one is unbounded, and their attempts cost nothing. Security planning that assumes a handful of capable adversaries is planning for the last war. The next one is attempted continuously, by everyone, at once.