The 72% Problem
In February 2026, OpenAI and Paradigm quietly released EVMbench, an open-source benchmark measuring how well AI agents can detect, patch, and exploit smart contract vulnerabilities. The results should keep every protocol team awake at night.
GPT-5.3-Codex achieved a 71% success rate at autonomously draining funds from vulnerable contracts. Six months earlier, GPT-5 managed just 33%. That's a 2.1x improvement in half a year.
This isn't theoretical. When an AI agent can execute end-to-end fund-draining attacks against 7 out of 10 vulnerable contracts — iterating through attack vectors, deploying exploit contracts, and verifying stolen balances on-chain — the economics of smart contract exploitation fundamentally change.
What EVMbench Actually Measures
EVMbench evaluates AI agents across three modes, each revealing different aspects of the offensive-defensive balance:
Detection Mode
Agents audit smart contract repositories and attempt to identify known vulnerabilities. Scoring is based on recall against ground-truth findings from human auditors (primarily Code4rena competitions).
Key finding: Agents often stop after identifying one issue rather than exhaustively auditing the codebase. This mirrors a common human auditor failure mode — anchoring on the first vulnerability found and missing deeper issues.
Patch Mode
Agents modify vulnerable code to eliminate exploitability while preserving intended functionality. Success requires passing both the original test suite and exploit verification.
Key finding: This is where AI agents struggle most. Maintaining full functionality while surgically removing subtle vulnerabilities — especially logic bugs that are intertwined with business logic — remains genuinely hard.
Exploit Mode
Agents execute end-to-end attacks against contracts deployed on sandboxed Anvil environments. Grading is programmatic: did the attacker's balance increase? Did the protocol's balance decrease?
Key finding: This is where AI excels. The objective is unambiguous ("drain funds"), the feedback loop is immediate (transaction success/failure), and the agent can iterate indefinitely. This asymmetry — exploitation being easier than defense — is the core problem.
The Asymmetry That Should Terrify You
EVMbench exposes a fundamental asymmetry in AI capabilities applied to smart contracts:
| Capability | AI Performance | Trend |
|---|---|---|
| Exploitation | ~71% | Rapidly improving |
| Detection | Below full coverage | Slowly improving |
| Patching | Weakest | Marginal improvement |
This mirrors the broader cybersecurity landscape, but with a critical difference: smart contracts are immutable. A traditional web application can be patched hours after a vulnerability is discovered. A deployed smart contract lives forever on-chain, and its vulnerabilities live with it.
The implication is stark: AI agents will soon be able to scan every verified contract on Etherscan, identify exploitable vulnerabilities faster than any human team, and execute attacks — all for the cost of API credits.
What This Means for Your Protocol
1. Pre-Deployment: The Audit Bar Just Went Up
If an AI agent can find and exploit 71% of the vulnerabilities in Code4rena-level contracts, your audit process needs to account for AI-augmented attackers. Practically, this means:
- Run AI-assisted audits yourself before deploying. Tools like Aderyn, combined with LLM-based review pipelines, should be a standard pre-deployment step — not a nice-to-have.
- Fuzz with intent. Echidna and Medusa remain essential, but configure them with exploit-oriented invariants: "no single transaction should be able to extract more than X," "total supply should never exceed Y."
- Adversarial simulation. Use AI agents to attempt exploitation of your contracts in staging environments. If GPT-5.3-Codex can drain your testnet deployment, a motivated attacker with the same tools will drain your mainnet.
2. Post-Deployment: Monitoring Is No Longer Optional
For contracts already live on-chain:
// Example: Circuit breaker pattern
contract ProtocolWithCircuitBreaker {
uint256 public constant MAX_SINGLE_WITHDRAWAL = 100_000e18;
uint256 public constant DAILY_WITHDRAWAL_LIMIT = 500_000e18;
uint256 public dailyWithdrawn;
uint256 public lastResetTimestamp;
modifier circuitBreaker(uint256 amount) {
if (block.timestamp > lastResetTimestamp + 1 days) {
dailyWithdrawn = 0;
lastResetTimestamp = block.timestamp;
}
require(amount <= MAX_SINGLE_WITHDRAWAL, "Single withdrawal too large");
require(dailyWithdrawn + amount <= DAILY_WITHDRAWAL_LIMIT, "Daily limit exceeded");
dailyWithdrawn += amount;
_;
}
}
Circuit breakers won't prevent exploitation, but they cap the damage. When an AI agent can iterate through attack vectors in minutes, the time between first exploit attempt and fund drainage collapses. Withdrawal limits buy your monitoring system time to trigger an emergency response.
3. Governance: Upgrade Paths Matter More Than Ever
Immutability is a feature until it's a vulnerability. Protocols should:
- Implement timelocked upgrade mechanisms via transparent proxies or the UUPS pattern
- Maintain emergency pause functionality with multi-sig controls
- Pre-authorize circuit breaker parameters that can be tightened without full governance votes
4. The Defensive AI Imperative
The most important takeaway from EVMbench: AI is better at attacking than defending, but that gap is closable.
OpenAI's $10M commitment to cyber defense API credits and Paradigm's release of EVMbench as open source are steps in the right direction. But protocol teams can't wait for the ecosystem to catch up. Actions to take now:
- Integrate continuous AI auditing into your CI/CD pipeline. Every PR that touches contract code should trigger an automated security review.
- Build exploit-detection monitoring that uses AI agents to simulate attacks against your live contracts (on forked state) continuously.
- Participate in EVMbench — run the benchmark against your own contracts to understand your exposure before an attacker does.
The Broader Picture
EVMbench benchmarks AI against Code4rena audit competition findings — these are vulnerabilities that human auditors found in time-boxed competitions. Many heavily deployed contracts like Uniswap, Aave, and Maker have undergone far more rigorous review.
But the long tail matters. Thousands of DeFi protocols secure meaningful TVL without Code4rena-level auditing. These are the contracts most vulnerable to AI-automated exploitation at scale.
The security landscape is shifting from "can a skilled hacker find this bug?" to "can a $20/month API subscription find this bug?" The answer, increasingly, is yes.
What's Next
EVMbench currently has limitations: single-chain only, sequential transaction replay, clean Anvil state rather than mainnet forks. Future versions will likely address these gaps, making the benchmark — and by extension, AI exploitation capabilities — even more realistic.
Smart contract security teams have a narrow window to adopt AI-assisted defense before AI-assisted offense becomes the default attack vector. The 71% exploit rate is a warning shot. The question is whether the industry will treat it as one.
This article is part of an ongoing series examining emerging threats in DeFi security. Follow for weekly deep dives into vulnerabilities, audit tools, and defensive strategies.
Top comments (0)