AI auditing has found real vulnerabilities, but don't celebrate too early. Reproducing and verifying are the hard parts; manual final review cannot be skipped.

The article concludes that AI agents can assist in auditing Ethereum code, and have already discovered real vulnerabilities such as CVE-2026-34219 in libp2p Gossipsub. The core bottleneck has shifted from discovery to verification. AI is adept at combining code and specifications to search for vulnerabilities and generate reproductions, but may misjudge unreachable paths as reachable, amplify severity, and inadequately identify vulnerabilities triggered by multi-step conditions. Therefore, all candidate vulnerabilities must be independently reproduced in real code, independently verified and deduplicated, and ultimately confirmed by humans for disclosure timing.