The Ethereum Foundation's Protocol Security team shares their methodology for running coordinated AI agents against Ethereum protocol code to find security vulnerabilities. The key insight is that finding bugs is the easy part — the real challenge is triage: distinguishing genuine vulnerabilities from false positives. The team runs many agents in parallel coordinating through a shared repository, requiring every candidate to have a self-contained reproducer that runs against real code before it counts as a finding. Common false positive patterns include panics only in debug builds, reproducers using unreachable internal states, and trivially-true formal proofs. The post outlines agent strengths (reading spec and code together, drafting reproducers) versus weaknesses (unreachable call chains, inflated severity, multi-step sequence bugs). A real CVE was found: a remotely-triggerable panic in libp2p's gossipsub (CVE-2026-34219). The conclusion is that AI agents moved the bottleneck from hypothesis generation to judgment at scale, and that human triage remains the critical product.
