On July 11, the Ethereum Foundation disclosed that its protocol security team used AI agents to conduct vulnerability mining on Ethereum client software to enhance network security. During testing, the AI successfully identified a vulnerability in the Gossipsub message propagation protocol that allows a remote attacker to trigger the node program to crash, causing validator nodes to go offline. The vulnerability has now been fully patched and has been registered as CVE-2026-34219.

However, the Ethereum Foundation noted that the biggest challenge for AI is not discovering vulnerabilities, but distinguishing real vulnerabilities from false positives. AI may not only generate vulnerability descriptions, impact analyses, and attack code, but also present issues that seem plausible yet do not actually exist; therefore, security researchers still need to conduct detailed verification. The foundation summarized three common types of false positives, including crashes that only occur in the test environment, attack paths that cannot be exploited in real-world environments, and invalid proofs in formal verification.

In addition, the Ethereum Foundation believes that AI is currently better at analyzing single-code issues, but its ability to identify complex attack chains formed by combining multiple legitimate operations remains limited—such attacks are precisely the main reason multiple crypto protocols were targeted this year. In the future, the Ethereum Foundation plans to have AI assist in generating potential attack paths, and then combine them with manual and automated testing for verification, to further improve the efficiency and accuracy of vulnerability discovery. #GateUS合规扩展佛罗里达