Ethereum Foundation Discovers Critical Security Flaw Using AI Agents... Technical Achievements and the Challenge of 'Hallucinations'

On July 9, 2026, the Ethereum Foundation's protocol security team announced the discovery of a critical network vulnerability using a coordinated swarm of AI agents. The identified CVE-2026-34219 is a flaw that can remotely shut down Ethereum validators, proving that AI can achieve substantial results in core areas of blockchain security. However, technical limitations were also revealed as significant human expert effort was required to verify the numerous false reports generated by the AI during the process.

Triage is the product. While AI can find bugs, the human verification process to determine which results are actual threats is the core of security auditing.

The security team deployed AI agents focused on system software, cryptographic code, and smart contracts requiring high precision. These agents were designed to find complex logical flaws that are difficult for traditional manual audits or existing automated tools to detect. The Foundation explained that while the AI succeeded in finding real bugs, the numerous 'confident' false reports presented during the process imposed a new type of workload on security experts.

CVE-2026-34219: Technical Analysis of the Gossipsub Vulnerability

The specific flaw discovered is a remotely triggerable panic occurring in the libp2p Gossipsub networking protocol. Gossipsub is a core component of the peer-to-peer (P2P) messaging layer used by Ethereum consensus clients, and the vulnerability was specifically identified in the library implemented in the Rust language. If an attacker sends a specially crafted PRUNE control message, the receiving validator node terminates abnormally, potentially causing disruption to the network consensus process.

• An attacker can induce a node crash by sending a specially crafted PRUNE control message.
• This causes validators to go offline, directly impacting the stability of the consensus layer.
• The vulnerability has now been fixed and disclosed along with a security advisory.

Through this experiment, the Ethereum Foundation confirmed that AI can be a powerful 'Security Force Multiplier' in the field of security. AI agents demonstrated the ability to complete code analysis, which would take humans months, in a short period and present potential attack paths from various angles. These proactive discoveries bought valuable time to build defense systems before actual network attacks occurred.

While the AI's detection capabilities were impressive, the Foundation emphasized that human intervention is absolute to translate this into actual security enhancement. This is because the process of filtering out actual threats from the numerous candidates found by AI goes beyond simple verification and requires high-level judgment based on a deep understanding of the entire system. The security team warned that uncritically accepting AI outputs could instead lead to a waste of security resources.

Signal and Noise: Limits of AI Security and the Importance of Triage

The majority of the approximately 1,000 candidate results presented by the AI agents were cases of 'hallucination' that appeared technically plausible but did not actually exist. The AI claimed flaws even in error-free code with a very logical and persuasive tone, and security experts had to precisely analyze each report to refute these false positives. This suggests that as the amount of information generated by AI increases, the human 'triage' capability to verify it could become a key bottleneck in security.

The Foundation's security team presented a new paradigm for the AI security era through the expression "Triage is the product." This means that the process of accurately classifying and proving which reports are threats requiring actual response, rather than simply finding bugs, determines the practical value of security services. This approach shows that even with the proliferation of AI tools, the role of human experts is not shrinking but rather evolving in a direction that requires a higher level of judgment.

As of July 11, 2026, the CVE-2026-34219 vulnerability has already been patched, and it has been confirmed that there are no issues with the stability of the Ethereum network. Through this proactive measure, the Foundation prevented potential network outages in advance and recommended that validator operators update to the latest software. This case is expected to be recorded as an important example of how active security defense using AI contributed to actual network protection.

In conclusion, AI has proven to be an innovative tool for strengthening the security of complex protocols like Ethereum, but it still requires the filter of human verification. The collaborative model where humans prove and resolve bugs discovered by AI is expected to become the standard for blockchain security in the future. As technological advancement accelerates, the importance of a hybrid security strategy that combines AI efficiency with human insight will grow even further.