Back to Markets
Crypto▼ Bearish
OpenZeppelin Founder Warns AI Agents Can Exploit All DeFi
Manuel Araoz, creator of the most-used smart contract standard, said AI-driven exploit discovery makes traditional audits obsolete. The next signal is whether bug bounties rise or a major hack is AI-attributed.
Continue with
The Warning from DeFi's Security Architect
Manuel Araoz, founder of OpenZeppelin, warned that all DeFi protocols are vulnerable to AI agents finding exploits. OpenZeppelin wrote the Solidity libraries that underpin most decentralized finance projects. The statement carries weight because it comes from the architect of the industry's primary security layer. Araoz argued that AI models can now scan smart contract bytecode faster and more creatively than any human team. The implication is that DeFi risk models built on past breach frequencies or audit pass rates are no longer reliable.
How AI Breaks the Auditor-Attacker Balance
The traditional security playbook for DeFi relies on a race: auditors find bugs before attackers do. When both sides use human labor, that race is roughly fair. AI agents break that balance in three ways. First, AI can fuzz-test contract states at a volume no human team can match. Second, it can recombine known exploit patterns – such as a reentrancy vulnerability from 2016 – into novel attack vectors that bypass current safeguards. Third, AI agents operating on Flashbots or MEV infrastructure can deploy and withdraw capital in the same block, making detection before execution nearly impossible. Araoz's point is that this combination creates a superhuman attacker already present in the network.
For liquidity providers and yield farmers, the practical consequence is that total value locked in any protocol becomes a target that can be assessed in real time by a machine. The asymmetry is not hypothetical. AI-driven arbitrage bots already dominate Ethereum blockspace. Extending that capability from price discovery to exploit discovery is a small step.