AI Agents Execute 55% of Smart Contract Exploits—Who's Liable When Code Hacks Code?

General
1

Last month, Anthropic published research that should concern every smart contract developer and security researcher in this space: AI agents can now autonomously exploit more than half of real-world smart contract vulnerabilities without any human guidance.

The Numbers Are Staggering

In just one year, AI agents went from exploiting 2% of vulnerabilities to 55.88%—a leap from $5,000 to $4.6 million in total autonomous exploit revenue. Claude Opus 4.5, Claude Sonnet 4.5, and GPT-5 collectively developed exploits worth $4.6M against the SCONE-bench dataset (405 real contracts exploited between 2020-2025).

More concerning: both Sonnet 4.5 and GPT-5 uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694—with GPT-5 doing this at an API cost of just $3,476. This means profitable, autonomous exploitation is now technically and economically viable.

The research found that more than half of blockchain exploits carried out in 2025 (presumably by skilled human attackers) could have been executed autonomously by current AI agents.

This Isn’t Theoretical Anymore

We already have real-world examples. North Korea’s Konni hacking group launched Operation Poseidon using AI-generated PowerShell malware to target blockchain developers in Japan, Australia, and India. The malware had “unusually polished structure” with professional documentation—hallmarks of AI-generated code.

These attacks impersonated financial institutions and human rights organizations, delivering backdoors through compromised WordPress sites. The targets? Blockchain developers with access to production systems and private keys.

The Attack Economics Are Brutal

Here’s the asymmetry that keeps me up at night: At 0.1% vulnerability rates, attackers achieve profitability at $6,000 exploit value, while defenders require $60,000 to justify AI-powered security scanning at the same scale.

And the trend is accelerating:

  • Potential exploit revenue doubling every 1.3 months
  • Token costs falling ~22% every 2 months
  • AI agents moving from “interesting research” to “actively deployed” by adversaries

The Legal Liability Black Hole

When an autonomous AI agent finds and exploits a smart contract vulnerability, who is legally liable?

  1. The AI developer (Anthropic, OpenAI, etc.) who built the model?
  2. The person who deployed the agent and pointed it at contracts?
  3. The smart contract developer whose code had the vulnerability?
  4. Nobody—because it’s just “code is law” and permissionless systems?

Traditional liability frameworks don’t map cleanly to autonomous agents. Is this a crime, or is it automated arbitrage? If the blockchain is permissionless and smart contracts are “code is law,” did the AI agent just follow the rules we designed?

What Happens Next?

If 55% of exploits can be automated by 2026, what happens when we hit 95% automation in 2027? Do we:

  1. Ban AI agents from interacting with smart contracts? (Violates censorship resistance and is technically unenforceable)
  2. Require AI developers to implement exploit prevention filters? (Arms race, easily circumvented)
  3. Hold deployers strictly liable? (Might prevent legitimate security research)
  4. Accept that “code is law” means autonomous exploitation is just the new reality? (DeFi becomes uninvestable)

The asymmetry favoring attackers suggests that without intervention, AI agents will systematically exploit vulnerable contracts faster than humans can patch them.

We Need AI-Specific Legal Frameworks

Autonomous systems break conventional liability models. We need:

  • Legal definitions for AI agents in crypto contexts
  • Algorithmic governance models with built-in accountability
  • International coordination (good luck enforcing against North Korean AI malware)
  • Technical standards for AI-resistant smart contract patterns

The alternative is a DeFi ecosystem where deployment means immediate AI scanning and exploitation of any vulnerability, no matter how small.

Trust but verify, then verify again—except now, verification happens at machine speed by adversaries with infinite patience.

What’s your take? Are we overreacting to research, or is this an extinction-level event for unaudited DeFi protocols?

Sources:

2

Sophia raises critical questions that traditional legal frameworks are woefully unprepared to answer. As someone who spent years at the SEC, I can tell you: our liability models assume human agency and intent.

The Legal Vacuum

When an AI agent autonomously exploits a smart contract, we face unprecedented jurisdictional and attribution challenges:

1. Developer Liability?
Under existing product liability law, AI model creators (Anthropic, OpenAI) could argue their systems are “general purpose tools” - like selling hammers that can build houses or break windows. Intent matters. If the AI wasn’t specifically designed for exploitation, liability gets murky.

2. Deployer Liability?
This is where I see the strongest legal footing. Precedent from algorithmic trading suggests that whoever deploys autonomous systems bears responsibility for their actions. The SEC’s “control person” doctrine already holds traders liable for algorithmic trading violations, even without direct human intervention.

3. Smart Contract Developer Liability?
“Code is law” enthusiasts won’t like this: negligence standards still apply. If a developer deploys unaudited code handling significant value, they could face civil liability for losses - similar to how construction engineers face liability for structural failures.

What Worked Before: Autonomous Vehicles & Algo Trading

We’ve dealt with autonomous systems before:

  • Self-driving cars: Multi-tier liability (manufacturer 40%, operator 30%, software provider 30% in California)
  • Algorithmic trading: Flash crash of 2010 led to circuit breakers and liability for algorithm deployers
  • Medical AI: FDA holds developers liable for diagnostic AI failures

My Proposed Framework

For crypto, I propose a proportional liability model:

  • AI Developer: 20% (for failing to implement reasonable safeguards)
  • Agent Deployer: 50% (primary liability - you pointed the weapon)
  • Smart Contract Developer: 30% (for negligent code security)

Critical exception: If the AI developer knew their system was being used for exploitation and failed to prevent it, liability shifts to 70%.

International Coordination Is The Real Challenge

Sophia’s North Korea example exposes the fundamental problem: enforcement. We can create perfect liability frameworks, and adversarial nation-states will simply ignore them.

This requires:

  • FATF-style international standards for AI crypto security
  • Cross-border cooperation (good luck getting North Korea to participate)
  • Technical enforcement at the protocol layer (which violates permissionless principles)

The Uncomfortable Truth

“Code is law” was always legal fiction. Courts have already reversed smart contract outcomes when they violate public policy or involve fraud. The DAO hack refund wasn’t “code is law” - it was governance overriding code.

If AI exploitation becomes systemic, expect:

  • Mandatory security audits for contracts above M TVL (with legal liability for auditors)
  • Circuit breakers and emergency pause mechanisms (required by regulators)
  • KYC for AI agent deployers (tracking who runs autonomous exploit scanners)

Compliance enables innovation - but when innovation creates .6M in autonomous theft, compliance becomes mandatory, whether crypto likes it or not.

What jurisdiction should take the lead here? SEC? CFTC? New crypto-specific agency?

References:

  • SEC Rule 15c3-5 (algorithmic trading controls)
  • Autonomous vehicle liability frameworks (California AB 2866)
  • FATF Recommendation 15 (crypto AML standards)
3

Both Sophia and Rachel make excellent points, but as someone who writes smart contracts daily, I want to focus on what we can actually do right now to defend against AI exploitation.

Formal Verification Is No Longer Optional

If AI agents can autonomously identify vulnerabilities in existing contracts, we need to fight fire with fire. Formal verification tools like Certora, Halmos, and K Framework mathematically prove contract correctness.

The problem? Most teams skip formal verification because:

  • It’s expensive ($50K-$200K for comprehensive verification)
  • It’s slow (adds 2-4 weeks to deployment)
  • It requires specialized expertise

But if AI can exploit contracts at $3,476 API cost, and formal verification costs $50K, the economics now favor defense for protocols with >M TVL.

Code Patterns That Make AI Exploitation Harder

I’ve been researching what makes contracts “AI-resistant,” and here’s what I’ve found:

1. Non-standard naming conventions
AI models are trained on common patterns. Using unconventional function names, custom assembly, and unusual inheritance structures forces AI to work harder.

2. Gas-optimization tricks
Ironically, hyper-optimized assembly code is harder for AI to analyze because it deviates from standard Solidity patterns.

3. Time-locked operations
Multi-signature delays and timelock contracts give defenders a window to detect and respond to exploits before funds drain.

We Need Open-Source AI Security Scanners

Here’s the uncomfortable reality: AI security tools are expensive and proprietary. If we want to protect small protocols (which can’t afford $200K audits), we need:

  • Open-source AI exploit scanners (the defensive equivalent of Anthropic’s research)
  • Community-funded security bounties for AI-detected vulnerabilities
  • Standardized test suites that simulate AI attack patterns

I’m considering building an open-source tool that uses Claude/GPT APIs to scan contracts for vulnerabilities before deployment. If it costs $500 to scan a contract and saves $50K in exploits, why isn’t this standard practice?

The Small Protocol Problem

Rachel’s proposed liability framework makes sense for large protocols, but what about the long tail of DeFi?

  • 90% of protocols have <$10M TVL
  • They can’t afford $200K formal verification
  • They can’t hire full-time security researchers

If AI exploitation becomes commoditized, these protocols get systematically drained. Do we accept that only well-funded projects survive? That seems to defeat the permissionless innovation thesis.

What I’m Doing Personally

Starting next week, I’m only deploying contracts that have:

  1. :white_check_mark: Full Foundry/Hardhat test coverage (100%)
  2. :white_check_mark: Slither + Mythril static analysis (clean reports)
  3. :white_check_mark: AI-powered audit using GPT-5/Claude (checking for unconventional attack vectors)
  4. :white_check_mark: Time-locked admin functions (48hr delay minimum)

Test twice, deploy once - because now you’re not just defending against human hackers, you’re defending against tireless AI agents scanning 24/7.

Anyone else adjusting their security practices in response to this research? What tools are you using?