It costs $1.22 to point an AI agent at a smart contract and have it search for exploitable vulnerabilities. Not a rough estimate. That is the actual average cost per run from Anthropic's research when they tested their frontier models against live, deployed contracts.

I have been reading through Anthropic's SCONE-bench paper and the recent DL News coverage on AI-driven hacking, and as someone who builds a lending protocol, I think this is the most important security story in DeFi right now. Not because AI agents are finding new categories of bugs. But because they are finding old, dumb bugs at a scale and cost that completely changes attacker economics.

Anthropic built a benchmark of 405 real smart contracts that were actually exploited between 2020 and 2025. They pointed 10 frontier AI models at these contracts and asked them to produce working exploit scripts. On contracts that were exploited after the models' knowledge cutoffs (meaning the models could not have memorized the answers), Claude Opus 4.5 alone successfully exploited 65% of them, corresponding to $3.7 million in simulated stolen funds. Across all models tested, the total was $4.6 million.

But the benchmark was retrospective. Those contracts had already been exploited by humans. The real question was: can AI find bugs that nobody has found yet?

So they pointed their agents at 2,849 recently deployed contracts on Binance Smart Chain. Both Sonnet 4.5 and GPT-5 found two genuine zero-day vulnerabilities and produced working exploits worth $3,694. The total API cost to scan all 2,849 contracts was $3,476. Barely profitable, but the proof of concept is what matters here.

The two bugs they found are what really stuck with me.

The first was a reflection token where the devs added a public function so users could calculate their expected rewards. They forgot to add the view modifier. In Solidity, if you do not explicitly mark a function as view or pure, it has write access by default. So this "calculator" function was actually updating the contract's internal accounting every time it was called. The AI agent figured out that calling this function hundreds of times in a loop would inflate its token balance, then it sold those tokens on PancakeSwap for real BNB. Potential profit: around $2,500.

The second was a token launchpad contract where the fee withdrawal function never validated whether the caller was the rightful beneficiary. If the token creator never set a beneficiary address, anyone could call the function and claim the fees. The AI found this. And four days later, a real human attacker independently exploited the exact same bug and drained about $1,000.

These are not sophisticated exploits. A missing view modifier. A missing require check. These are the kind of bugs that any Solidity developer would catch in a code review. But they sat on mainnet, with real money at risk, because no human thought it was worth the time to audit these small contracts.

That is the fundamental shift. Previously, hunting for smart contract bugs was expensive and time-consuming. Hackers had to spend hours reading code, so they only targeted high-value contracts where a successful exploit would justify the effort. AI changes that equation completely. At $1.22 per contract, an attacker can scan everything. Every old fork. Every dusty deployment. Every under-maintained vault with a few thousand dollars in it.

Security firms are already seeing evidence of this in the wild. Hacken's audit lead Stephen Ajayi told DL News that they observe "repeated, identical exploit attempts across multiple contracts simultaneously," which is consistent with automated AI-driven reconnaissance. Halborn's field CISO Gabi Urrutia described it as making "legacy-contract hunting cheaper, faster, and more scalable." The recent $26 million Truebit hack, which targeted a pricing-logic flaw in an older contract compiled with Solidity 0.6.10, fits exactly this pattern.

The pace of improvement is alarming. According to Anthropic's data, exploit revenue from AI agents has been doubling roughly every 1.3 months. The token cost to produce a successful exploit dropped 70% across four model generations in just six months. An attacker today can get 3.4x more successful exploits for the same compute budget compared to six months ago.

Gerrit Hall, co-founder of smart contract security platform Firepan and a five-year veteran of Curve Finance, went as far as saying "everybody should stop using DeFi" because offensive AI is advancing faster than defensive tooling.

I think that is too extreme, but his core observation is right. There is a real gap between how fast attackers are adopting AI and how fast defenders are catching up.

The good news is the same technology works for defense. Last month, Octane Security used their AI tool to find a high-severity liveness bug in Nethermind, the Ethereum execution client used by 38% of mainnet validators. The bug could have halted block production across all Nethermind-based proposers. It was found before anyone exploited it, disclosed responsibly, and the Ethereum Foundation paid the maximum $50,000 bounty. During the Fusaka audit contest, Octane's AI-assisted approach produced 9 severe findings across 6 clients and placed 4th out of 500+ researchers.

But defense requires a mindset shift that most protocols have not made yet. As Urrutia put it, "'audited once' is no longer a serious security model." If attackers can continuously rescan the long tail of old contracts, then dormant risk becomes active risk.

This is something I think about a lot while building Centuari. After reading through this research, here is what I think builders actually need to change.

Stop treating audits as a one-time event. If a new frontier model drops every few months and each generation is 3.4x more capable at finding exploits, your audit from six months ago was done with inferior tools. AI-powered scanning needs to be part of your CI/CD pipeline. Every commit should get checked, not just the final deployment. Tools like Octane Security and Nethermind's AuditAgent are already doing this, and they are catching bugs that traditional audits missed.

Test for economic manipulation, not just happy paths. The two zero-days Anthropic found were not traditional code logic errors. They were economic design flaws. A missing view modifier that allowed state mutation. A missing access control check on a fee withdrawal. Standard unit tests would not catch these. You need invariant tests that simulate adversarial behavior. What happens when someone calls your function 500 times in a loop? What happens when msg.sender is not who you expect? Foundry's fuzz testing and invariant testing capabilities exist for exactly this reason, but most teams still write basic unit tests and call it done.

For lending protocols, harden your oracle integrations. Oracle integrations are the highest-risk attack surface in this new environment. The Anthropic research focused on token contracts, but lending protocols have an even bigger target on their backs because of the complexity of price feeds, liquidation logic, and interest rate calculations. Build price sanity checks that reject oracle values outside expected ranges. Add circuit breakers that pause the protocol if asset prices move beyond a threshold within a single block. Moonwell lost $1.8 million earlier this year because an oracle returned $1.12 instead of $2,200 for cbETH and nothing in the system flagged that as obviously wrong. That is the kind of check you can implement in a few lines of Solidity that would have prevented millions in losses.

Assume your old deployments are being scanned right now. If you have deprecated contracts, old market deployments, or legacy code that still holds user funds, those are exactly the targets AI agents are going after. Low TVL, low attention, old compiler versions. Migrate funds out of anything you are not actively maintaining, or at minimum run the latest AI scanning tools against those contracts yourself.

The question is no longer "has our code been audited?" It is "when was the last time our code was scanned by the latest generation of models, and what did they find?"

DeFi security is becoming an arms race between AI attackers and AI defenders. The protocols that survive will be the ones that treat security as a continuous process, not a checkbox. The same AI that is being weaponized against us is available for defense. The only question is whether you are using it before the attackers do.

Sources:
Anthropic SCONE-bench research: https://red.anthropic.com/2025/smart-contracts/ DL News, "Crypto hackers armed with AI stand to make millions attacking old code": https://www.dlnews.com/articles/defi/crypto-hackers-are-using-ai-to-attack-old-smart-contracts/
DL News, "AI-powered audit uncovers high-severity bug in Ethereum software": https://www.dlnews.com/articles/defi/ai-flags-high-severity-nethermind-bug/

I share what I learn while building in web3. If that sounds useful, you can find me on X (@hwisesa23) and LinkedIn (linkedin.com/in/heinrich-wisesa).