February 2026 compressed this entire problem into seven days. First, Moonwell's markets mispriced cbETH by a factor of two thousand because code co-authored by an AI model carried an unchecked assumption — $1.78 million in bad debt. That same week, industry digests reported that an AI auditor had taken the top spot in a bug bounty competition worth $500,000, judged against human researchers. In the same stretch, the Solidity team shipped an emergency compiler release for a high-severity bug in transient storage.

Machines wrote the vulnerability, found the vulnerability, and patched the toolchain the vulnerability lived in. Each role was played well. The open question is not whether machines can do security work — that is settled. It is what everyone else is supposed to stand on while they do it.

What AI Auditors Are Actually Good At

The honest scorecard is more interesting than either the hype or the dismissal. AI review is genuinely superhuman at scale problems: reading a codebase end to end at three in the morning without losing attention, pattern-matching a new contract against the taxonomy of every exploit ever published, enumerating the inputs nobody thought to test. The benchmarks now forming around this — run on hundreds of real incidents — show agents detecting vulnerability classes that human reviewers miss when fatigue and familiarity set in.

It is also genuinely limited at exactly the place where the Moonwell failure happened: assumptions between systems. An oracle that treats a ratio as a price is invisible to a reviewer of either species if the spec doesn't say what the oracle is supposed to return. The a16z benchmark work found the same shape from the attack side — models identify the flaw and then stumble on multi-step consequences. AI review widens coverage; it does not create intent. It can tell you what the code does. Only a specification can say whether that is what it should do.

So the mature posture is a division of labor: machines read everything, humans own the judgment, and neither substitutes for the other. Fine. But that posture quietly creates a new dependency, and it points somewhere uncomfortable.

The Verdict Becomes the Trust Point

When a human firm audits a protocol, the industry's answer to "why do you trust this contract?" is a PDF with a signature and a reputation. The report is an artifact: it names the commit it reviewed, the findings, the date. You can dispute it, sue over it, or compare it against what actually broke.

Now replace the firm with a pipeline: an AI system that scanned the code, triaged the findings, possibly wrote parts of the fixes, and emitted a clean bill of health. Who ran the model? Which version, against which build, with what configuration? Did the scan complete, or did it fail open? An AI audit is a claim about work nobody directly observed, produced by a system whose internals even its operators do not fully control, at a scale where sample-checking by humans is the exception. The verdict has become the trust point — and unlike the PDF, it comes with no natural way to check it.

This is not a hypothetical worry. The numbers behind this series — more than $3.6 billion lost across 245 incidents since the start of 2025, per CoinGecko's security report — were accumulated under a regime of audits, badges, and assurance pages. Adding machine judgment to that pipeline increases its throughput. Throughput without verifiability just produces more certificates at the same assurance level.

Evidence Needs an Anchor

The property the audit verdict is missing is the property that makes evidence usable: everyone can establish, later, exactly what was claimed, when, about what, and that nobody revised it since. Auditors have approximated this with letterhead for a century. The difference now is that the claims arrive machine-generated, at machine volume, and need verification at machine speed — by delegators choosing a market, insurers pricing coverage, treasuries approving a deployment, or another AI agent deciding whether to interact with a contract at all.

We've argued before that proofs only become evidence when they live somewhere an auditor can find them, with a timestamp nobody disputes and no way for the operator to revise the collection — and that AI systems making consequential decisions need exactly this kind of append-only attestation trail. An audit verdict is a consequential decision. It should be anchored the same way: hash of the build, hash of the report, model and version identity, timestamped into a ledger nobody in the ecosystem controls. The verifier — human or machine — stops trusting the auditor's reputation and starts checking the chain of custody.

Bitcoin's role here is unfashionable but exact. Anchoring attestations into a ledger with more accumulated proof-of-work than any alternative gives the timestamp its dispute-resistance. Verifiable-inference techniques push one step further, letting a skeptical party check properties of the computation itself rather than trusting the operator's account of it. Neither turns an AI audit into truth. Both turn it into something a stranger can evaluate — which is the entire difference between a claim and evidence.

The Posture This Series Adds Up To

Five articles, one architecture of distrust. Verify the code, because its author may be a machine with a talent for plausible errors (1). Contain the agents, because anything that can be talked into moving money eventually is (2). Assume the attacker has the same tools and works at the same speed (3). Take human recognition out of the authorization path, because faces are now content (4). And anchor every machine verdict — audit, scan, attestation — somewhere nobody can quietly revise (5).

The AI era does not change what security is. It changes the cost structure on both sides, which means the protocols that survive will be the ones that were structured to be verified — by humans, by machines, and eventually by machines verifying machines, ad infinitum, with every link in that chain anchored to something that does not take anyone's word for anything. That is the standard we build to. It turns out to be the only one that scales.