The Ethereum Foundation's Protocol Security team has been running coordinated AI agents against the network's core systems, and the agents found real bugs—including a remotely-triggerable panic in libp2p's gossipsub, now disclosed as CVE-2026-34219. But the team's surprise wasn't that the agents found bugs; it was how little effort went into discovery and how much went into distinguishing real findings from plausible-looking noise.

In a blog post, the team describes treating an agent as a search tool, similar to a fuzzer but with richer output. They run many agents in parallel, coordinating through the repository itself with shared state in version control. Roles emerge from the work: recon turns attack surfaces into testable hypotheses, hunting traces code paths and builds reproducers, gap-filling tracks coverage, and validation independently re-checks candidates. Each candidate must meet a strict schema—target, invariant, mechanism, observable success, a self-contained reproducer, and a dedup key—before it counts as a finding.

The team emphasizes that a candidate isn't a finding until a reproducible artifact runs against the real code for someone who didn't write it. This catches common false positives: panics that only occur in debug builds, reproducers that construct impossible internal values, and formal proofs that don't constrain the intended behavior. Most candidates are wrong, duplicate, or out of scope, and acceptance rates vary widely by target. The team notes that other groups, including Anthropic and Cloudflare, have converged on similar methods, with triage being the hard part everywhere.

The post concludes that the triage process itself is the product. Agents are good at reading specs alongside code and drafting reproducers, but they can mislead with unreachable call chains, gamed success checks, and inflated severity. The team warns against assuming consistent performance, citing a 'jagged frontier' where a model that recovers a full exploit chain on one codebase may fail basic data-flow tracing on another. Every candidate must be checked on its own merits.