AI agents autonomously develop smart contract exploits worth $4.6 million
Anthropic's red team and researchers demonstrated that AI agents using commercial models can autonomously identify and exploit vulnerabilities in smart contracts. Testing showed the models generated $4.6 million in simulated exploits on known vulnerabilities and discovered new zero-day exploits, with the cost of such attacks declining rapidly as AI capability increases.
What happened
Anthropic's red team and researchers from the Machine Learning Alignment & Theory Scholars Program tested commercial AI models including Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI's GPT-5 against smart contracts. The models collectively developed exploits worth $4.6 million on contracts exploited after their training data cutoff.
When tested on 2,849 recently deployed BNB Chain contracts with no known prior vulnerabilities, GPT-5 and Sonnet 4.5 uncovered two zero-day vulnerabilities producing exploits worth $3,694. One vulnerability stemmed from a missing view modifier allowing token balance inflation; another allowed arbitrary fee withdrawal redirection. Researchers noted the cost to run the agents was $3,476, making the exploits profitable.
Reported impact
The research demonstrates that profitable, real-world autonomous exploitation of smart contracts is technically feasible. Researchers tested 10 AI models collectively against a benchmark of 405 contracts exploited between 2020 and 2025, producing exploits for 207 contracts with simulated losses of $550.1 million.
Index analysis
Analysis of four generations of Claude models showed the median number of tokens required to produce a successful exploit declined by 70.2%, indicating that the cost of autonomous exploitation will decrease over time as models improve.
Governance controls
Researchers argued the findings underscores the need for proactive adoption of AI for defense against such exploits.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.