Ethereum Foundation says AI agents found and helped disclose bug in libp2p code

AI used across security roles

According to the Foundation’s security team, the work is being carried out by a fleet of AI agents assigned to distinct tasks rather than a single tool scanning code in isolation. The agents were organized around functions including reconnaissance, hunting, gap-filling and independent validation.

The stated goal is to widen coverage across complex protocol software and generate candidate findings that can then be checked against real implementations. Every potential issue, the team said, had to be backed by a reproducible proof on actual code before it could be treated as a confirmed vulnerability.

Real bugs, but a different bottleneck

The Foundation said the notable outcome was not simply that AI agents were able to find bugs, but that the larger burden shifted elsewhere. In its account, less effort went into generating hypotheses about possible flaws and more effort went into determining which findings were genuine.

That means AI has not removed the need for security researchers. Instead, the team said, the work now centers on judging results at scale, maintaining an internal view of known issues, building reliable methods for verification, conducting triage and handling disclosure.

The team described this as a shift in the bottleneck rather than its elimination. In practice, the hardest part of the workflow was said to be separating real vulnerabilities from findings that only appeared convincing, underscoring the continued need for human judgment.

libp2p issue disclosed

One of the confirmed issues was a remotely triggerable panic in the libp2p gossipsub library. The library underpins Ethereum’s peer-to-peer messaging layer, making the finding relevant to core network communications.

The Foundation said the issue has been resolved and publicly disclosed under CVE-2026-34219. The source material did not provide further technical detail about the exploit path or the precise impact beyond describing it as a genuine vulnerability and a panic condition that could be triggered remotely.

Broader implications for protocol security

The account from the Protocol Security team presents AI-assisted review as a way to expand the amount of code and behavior that can be examined, while leaving final validation to humans. The Foundation’s framing suggests that coordinated agents may be useful for surfacing more candidate issues across large systems, but that the reliability of those results depends on careful triage.

That distinction appears central to the approach: the value of the AI system lies in scale and coverage, while the risk lies in trusting outputs too quickly. The Foundation’s description emphasizes verification and disclosure discipline rather than treating AI findings as authoritative on their own.

More broadly, the report points to an emerging model for blockchain security work in which automation increases the volume of leads, but expert review remains the deciding step before a bug is confirmed and acted on.