smartcontracts

A new study by the Anthropic Fellows and MATS programs shows that frontier AI models can already find and exploit real-world vulnerabilities in smart contracts, raising the stakes for DeFi security.

Using SCONE-bench, a dataset of 405 exploited contracts, models including GPT-5, Claude Opus 4.5, and Sonnet 4.5 collectively generated $4.6 million in simulated exploits. Importantly, these were attacks on contracts hacked after the models' knowledge cutoffs, showing that the exploits weren't simply regurgitated training data.

Agents didn't merely identify bugs; they generated complete exploit scripts, sequenced transactions, and drained simulated liquidity in ways almost indistinguishable from real attacks on Ethereum and BNB Chain.

Researchers pushed further: could these models find vulnerabilities before anyone exploited them?

Scanning 2,849 fresh BNB Chain contracts, GPT-5 and Sonnet 4.5 uncovered two true zero-days worth $3,694 in simulated profit. One was an exploit through a missing view modifier that enabled the agent to inflate its token balance, while another allowed arbitrary redirection of fee withdrawals. In each case, the AI created executable scripts to monetize the flaws.

Although the nominal dollar amounts are small, the implications are huge: profitable, autonomous exploitation is now possible — and it's affordable. The total cost of the scanning was just $3,476, or about $1.22 per run.

As models become increasingly powerful and less expensive, researchers expect the gap between contract deployment and exploitation to shrink dramatically, especially in DeFi, where pools of capital are public and instantly targetable.

Crucially, the authors warn these capabilities are not limited to crypto: the same reasoning that lets an AI inflate a token balance can apply to traditional software, back-end infrastructure, and any system guarding valuable assets.
The research is less a prediction than a warning: AI models can already carry out operations that only the most elite human attackers could previously perform. For crypto builders, the race is now on for defenses to catch up.
#AI #Cybersecurity #SmartContracts #DeFi #BlockchainSecurity