Ethereum Foundation: The bottleneck of AI auditing has shifted from discovering vulnerabilities to verifying vulnerabilities

Wu learned that the Ethereum Foundation's Protocol Security Team published an article summarizing methods and experiences in using AI agents to audit Ethereum protocol code. The team stated that AI agents have already discovered real security vulnerabilities, including the libp2p Gossipsub remote trigger crash vulnerability (CVE-2026-34219), but the main bottleneck in security audits has shifted from finding vulnerabilities to verifying their authenticity.

The article argues that AI is more suitable as a vulnerability search tool rather than a final arbiter. It excels at combining code and specifications to discover potential vulnerabilities, verify security invariants, and generate vulnerability reproduction code. However, it also tends to misjudge actually unreachable call chains as reachable, exaggerate the severity of vulnerabilities, and has limited ability to recognize vulnerabilities that require multiple legitimate steps triggered in a specific sequence. Therefore, the team requires that all candidate vulnerabilities must be independently reproducible in real code, undergo independent verification and deduplication, and ultimately be confirmed by humans as to whether the vulnerability is valid, whether it is a duplicate report, and when to disclose it.