Autonomous smart-contract security · evidence, not alerts

Attackers have AI agents now. So do you.

Three independent AI agents. One evidence chain. SC Auditor finds an attack path, proves it in an isolated simulation, tries to disprove its own result, and hands your team a reproducible dossier.

Join the waitlist Protocol team or insurer? Request a private briefing

An unfiltered sample. Not a curated list of broken contracts.

contracts ~4,800 deployed DeFi contracts analyzed
hypotheses 488 attack hypotheses preserved
confirmed 148 outcomes confirmed in isolated EVM simulation
high 6 rated High severity

The contracts were taken as-is from Datai's contract database, with no pre-screening for suspected flaws.

Figures as of 19 Sep 2026 · private research preview

01first agent

Find

Reads the contract the way an attacker would, then proves the attack in a simulation where nothing real can be harmed.

  • Studies source, deployed runtime behaviour, dependencies, privileged roles, asset flows and protocol accounting, and generates attack hypotheses instead of pattern-matching known shapes.
  • Writes fresh tests and runs each attack plus a negative control, measuring who gains and who loses: attacker, protocol, users.
  • All exploit work runs in isolated local EVM environments or read-only forks pinned to an exact historical block. Nothing is broadcast. No private keys are used.
01load source ▸ 14 contracts · 3 proxies · 2 libraries
02map roles ▸ owner · keeper · treasury · <unprivileged>
03hypothesis #07 ▸ reward paid from principal pool
04fork pinned ▸ block #██,███,███ · read-only
05test test_exploit_rewardDrain() ▸ PASS · control ▸ no effect
06delta attacker +1.00 · users −1.00 · broadcast ▸ none
 
isolated fork · pinned block · no broadcast

02second agent

Challenge

An independent agent gets the evidence, not the confidence, and tries to break the claim.

  • Reproduces the result from scratch under the same controlled conditions.
  • Challenges assumptions, tests competing explanations and hunts false positives.
  • A finding survives only because a second agent failed to disprove it.
01review reproduce ▸ 3/3 runs match
02review alt-explanation ▸ rounding artefact? rejected
03review alt-explanation ▸ test harness bias? rejected
04review hypothesis #11 ▸ REFUTED · discarded
05review hypothesis #07 ▸ refutation failed · survives
 
independent · adversarial · reproduce or refute

03third agent

Prove

Every surviving case becomes a hash-anchored dossier an engineering team can act on.

  • Security property violated, mechanics, controlled exploit and negative control.
  • Measured state and economic impact, evidence hashes, remediation direction.
  • The regression tests that prove the fix, so the bug stays fixed.
01seal dossier ▸ case ████ · 9 sections
02hash evidence ▸ sha256:8f3a…c91e
03attach exploit.t.sol · control.t.sol · regression.t.sol
04attach docker-compose.yml · fork.lock · README.md
05handoff ▸ awaiting human disclosure decision
 
sealed · hashed · reproducible

04 · Evidence Dossier · what your team receives

Not a verdict. An evidence chain.

Every case that survives the full lifecycle is sealed into a dossier that connects each claim to executed tests, measured state changes, a negative control and hash-anchored evidence. Engineers can reproduce it. Insurers can trace it.

  • A clear explanation of what breaks and who is at risk.
  • A controlled, reproducible exploit and its negative control.
  • Measured attacker, user and protocol impact.
  • Independent adversarial review by a separate AI agent.
  • Remediation direction and the tests required to prove the repair.
Illustrative sample — not a real caseRewardVault.sol · case ████
block#██,███,███
environmentisolated fork · read-only
broadcastnone
private keysnone
Security property violated
Solvency of the withdrawal pool. Rewards must never be paid from balances that back user principal.
Mechanics
claim() pays rewards from the same pool that holds deposits. A claimant leaves with principal plus rewards; the remaining depositors inherit the deficit.
Controlled exploit
function test_exploit_rewardsFromPrincipal() public {
    _deposit(alice, 100e18);
    _deposit(mallory, 100e18);
    vm.warp(block.timestamp + 30 days);
    vm.prank(mallory);
    vault.claimAndWithdraw();           // leaves with 100e18 + rewards
    assertLt(vault.totalAssets(), vault.totalPrincipal());
}
Negative control
Honest claim without withdrawal: pool remains solvent. Control passed — the effect is specific to the sequence, not to the harness.
Peer-review verdict
Independent refutation attempted — failed. Reproduced 3/3 under identical pinned state. Alternative explanations (rounding artefact, harness bias) rejected.
Measured impact
attacker +12.4% of pool · users −12.4% of pool · protocol 0. Deficit is permanent until the pool is recapitalised.
Evidence hash
sha256:8f3a19c2e7…b04d6c91e
Remediation direction
Separate the reward reservoir from principal accounting. Pay rewards from a dedicated balance and revert when it is exhausted.
Required regression test
test_invariant_principalNeverFundsRewards() — must hold across arbitrary deposit / claim / withdraw sequences (fuzzed).
■ sealed · hash-anchoredsha256:8f3a19c2e7…b04d6c91edisclosure: human-controlled

Reproduced in simulation · nine failure modes

Examples of impact, not a count of affected protocols

How real contracts fail under execution.

Smart-contract failures rarely live in one line of code. They emerge from permissions, timing, token behaviour, external calls, arithmetic and live state interacting. Each of these was reproduced end-to-end in a controlled EVM, with the protocol identity withheld.

  1. case 01High

    Rewards paid from user principal

    ImpactYield silently consumes the funds backing withdrawals. Once the surplus is gone, honest users may be unable to recover principal.

  2. case 02High

    The same fee entitlement claimed twice

    ImpactThe extra payout comes from other participants’ pooled fees, leaving them with an insolvent balance.

  3. case 03High

    A multi-step exit that can be hijacked mid-way

    ImpactWhen leaving a position takes more than one action, the gap between steps lets an unrelated account capture the entire proceeds.

  4. case 04Medium

    A reward schedule anyone can rewrite

    ImpactA distribution parameter changeable without privilege, at negligible cost, denied more than 99% of expected rewards in the controlled test. The disruption can be repeated.

  5. case 05Medium

    Reward accounting broken by a precision error

    ImpactA scaling factor applied twice makes legitimate reward funding revert as the protocol grows, and strands part of the pool where it can never be claimed.

  6. case 06Medium

    Phantom balances diluting honest users

    ImpactRewards are divided as if nonexistent stake were still active. Honest users receive less, and the missing share can become unrecoverable.

  7. case 07Medium

    Earned rewards diluted after the work was done

    ImpactThe denominator stays mutable until claim time, so later activity can shrink a payout for work already performed.

  8. case 08Low

    One legacy record permanently blocking all claims

    ImpactA partial migration makes a valid older claim hit a zero denominator, locking every pending reward for the affected account.

  9. case 09Low

    A valid participant rounded down to zero

    ImpactThe transaction succeeds and the user receives nothing. Silent zero-value accounting can go undetected across many distributions.

Safety · responsible disclosure by design

Built to help protocol teams. Never to surprise them.

Agents run the investigation. Humans control every disclosure decision.

  1. No testing transaction is ever broadcast to a live chain.
  2. No private key is used to reproduce an exploit.
  3. Simulations are isolated or pinned to an exact read-only state.
  4. Protocol identities and actionable details stay confidential.
  5. A human controls all outreach and disclosure.

Why now · the offensive capability is public

Why now

In December 2025, researchers at Anthropic and MATS showed frontier AI agents autonomously producing working exploits worth $4.6M in simulation against contracts hacked after the models’ training cutoff. The offensive capability is public. The defensive one has to be too.

Source · Anthropic · AI agents find smart contract exploits · Dec 2025 ↗

Early access · defenders first

Put an auditor that never sleeps on your contracts.

Private research preview · EVM chains

We are opening early access to protocol teams, insurers and security leaders who want autonomous systems to strengthen the defenders first.

No spam. One email when your access opens.

■ recorded · evidence chain updated

You are on the list.

We will email you once when your access opens.