The triage is the product: running AI agents against Ethereum's protocol code (blog.ethereum.org)

The Ethereum Foundation's Protocol Security team has been experimenting with coordinated AI agents to analyze protocol code, uncovering real vulnerabilities, such as a recently disclosed remotely-triggerable panic in Ethereum's core gossipsub component. While the novelty lies not in finding bugs but in efficiently triaging them, the team emphasizes that the challenge is distinguishing genuine vulnerabilities from false positives. The AI agents provide detailed reports, including observable proofs and hypotheses for validation, allowing client teams and researchers to better understand the significance and severity of the findings. This approach reflects a shift in the AI/ML community towards utilizing powerful models for code audits, a method now being adopted by various organizations like Anthropic and Cloudflare. The focus on effective triage is critical; as the volume of AI-generated findings increases, so does the need for human oversight to ensure the legitimacy of each report. The article underscores the importance of established practices such as reproducible failures and detailed tracking to maintain trustworthiness in AI findings, ultimately highlighting that while AI can generate leads more rapidly, the human element remains essential in validating and verifying results, making the quality of judgment paramount in the bug triage process.