Crypto's Two Answers to AI Bug Hunters

What it is

A Bankless piece, written 23 October 2026, arguing that crypto is answering cheap AI bug discovery in two ways: keep the ability to patch fast (agility), or shrink code until it can be proven correct (minimalism plus formal verification). The page adds detail the summary leaves out.

Evidence the page cites

• Bitcoin Core merged the policy change on 22 October 2026. Bugs "that can be found with a simple prompt to an LLM" are now fixed and shipped quickly instead of sitting under embargo for up to a year. The change's author is Antoine Poinsot.
• Two critical PHP flaws found with help from AI models left about 1.3M internet-exposed hosts vulnerable.
• Initia halted its network on 23 October after an attacker used what cofounder Zon called a "Day 0 bug" to mint tokens and bridge out about $2.7M. The page says AI use is unconfirmed and only "safe to assume".
• Anthropic's smart contract research found simulated exploit revenue from frontier models doubling roughly every 1.3 months in 2025.

The two answers

Agility. Starknet's community voted to research becoming an independent post-quantum L1 so it can upgrade cryptography on its own schedule. CEO Eli Ben-Sasson puts quantum's arrival at "2 years". Justin Drake urged planning for "bunker mode" (moving funds to fresh addresses).

The page names the cost: admin keys and upgrade paths are attack surface, and rule changes add bugs. Ethereum pulled Glamsterdam from its Hoodi testnet because research showed its gas changes could alter how deployed contracts behave.

Minimalism. Ethereum developer Ross (z0r0z) frames this as a "walkaway test": the system should stay safe if its builders vanish. Vitalik says Ethereum's roadmap went "hash-only" partly because hashes have no structure for AI-accelerated math to exploit. The flip side is that public, immutable code is readable by AI attackers and cannot be patched.

Formal verification numbers

• In research with Theorem published 22 October, Anthropic used Claude to prove that 239 entry points across 123 open-source libraries cannot crash on any input up to 64 MB, under stated assumptions. It took a few weeks.
• For comparison, the seL4 kernel took two person-years to build and 20 to verify.
• Cost: a typical proof ran about 600,000 lines for a program of about 18,000 machine instructions, which can take hundreds of millions of AI tokens.

Caveats

• A proof covers only the properties specified, not every possible bug.
• Proofs scale with code size, so the approach favours small, single-purpose contracts.
• The author expects agility to remain necessary for large evolving systems such as L1s and rollups.
• The page gives no patch steps, commands or detections. It is a trend argument.