AI Tools Could Transform Crypto Security Audits

AI-driven security tools are becoming increasingly accessible and could significantly affect the cost and efficiency of smart contract audits within the crypto industry. A notable example is Mythos, an AI system that autonomously identifies vulnerabilities in code, potentially reducing the cost of audits to near zero, as stated by Alexander Urbelis, chief information security officer at ENS Labs, who noted, "It pushes the price of a basic audit toward zero." This advancement allows for rapid assessments that could previously only be performed by skilled professionals and at significant expense.

Traditionally, smart contract security has faced financial barriers, limiting extensive audits. AI technology like Mythos marks a shift in the auditing approach, as these systems possess reasoning capabilities—enabled, for instance, by analyzing the intended function of the code versus its actual performance. This newfound capability is especially relevant in the crypto landscape, where smart contract transparency paired with substantial bug bounty budgets can widen the net of vulnerability detection.

David Schwed, COO of SVRN and founder of a cybersecurity master's program at Yeshiva University, highlighted the transformative potential of these AI models: "These models now operate the way a human attacker does." The implication is that AI tools are capable of continuous security monitoring, allowing for ongoing updates and suggested fixes rather than relying on a singular, costly audit process. Schwed emphasized that if security evaluations translate into affordable and continuous checks, it could redefine expectations within the industry regarding due diligence and oversight.

As these AI security solutions become ubiquitous, the industry may face new standards for audits. Urbelis pointed out that the availability of advanced AI analysis might shift liability, stating, "A clean AI report will be seen as no defense." Investors could soon expect AI-assisted audits before funding projects, suggesting a potential shift in how negligence is perceived in crypto security decisions.

However, experts caution that while AI tools can assist in identifying technical flaws, they cannot fully replace human oversight. Many significant security breaches have resulted from social engineering and operational failures rather than just coding errors. For instance, Urbelis referenced a recent breach involving the Drift platform, emphasizing that the human element in security is crucial: "The smart contract did exactly what it was told; the authority behind the instruction was what was compromised and abused."

Consequently, while AI has the potential to alleviate some security challenges by making vulnerability detection faster and more cost-effective, it does not eliminate the need for experienced human auditors to assess complex economic and incentive structures that can lead to breaches. Schwed reiterated this, remarking that simply relying on AI tools without proper human knowledge would not guarantee safety: "If the person running the tool can't evaluate what comes back, you haven't bought security, you've bought a false sense of it."