An AI agent found a bug that could have crashed Ethereum validators, but humans had to prove it was real

[Cyclops46]

The Ethereum Foundation's Protocol Security team disclosed a vulnerability where a single crafted network message could remotely crash a validator node, tracked as CVE-2026-34219 and fixed before anyone exploited it. The bug lived in the Rust implementation of libp2p's gossipsub protocol, the peer to peer messaging layer that Ethereum consensus clients depend on to pass blocks and attestations around the network

What makes this notable is how it was found. The Foundation pointed coordinated AI agents at the software validators actually run, organized into recon, hunting, gap filling and validation roles coordinating through a shared repository with no central dispatcher. One of those agents flagged the flaw, an integer overflow in how the software handles message expiry timing that let any unauthenticated peer trigger a crash with zero special access needed

The harder story here is everything the AI got wrong. The agents also produced a pile of confident, detailed, well written findings that turned out to be false positives, crashes that only occur in test builds with extra safety checks, attacks that only work if a dangerous value is planted by hand rather than delivered by an outsider, and formal proofs that technically pass by proving something trivially true. Each read as convincing as a real bug and took real human effort to rule out

The Foundation's conclusion is a genuinely useful template for anyone using AI for security work broadly, let the agent propose what is worth testing, but always verify with a working proof of concept and human review rather than trusting the AI's own confident narrative about severity

ETH news: Ethereum Foundation says AI found bug that could take validators offlinewww.coindesk.com

[Robin13]

The false positives being just as confident and well written as the real bug is honestly the scariest part of this whole story