I will be upfront and compact:
- our AI tool has already better coverage than most audit companies (and no false-positives)
- every @bailsecurity audit will now include our AI tool as component
Everyone who knows me, knows I’m not talking any bullshit.
Another big AI headline and more and more nonsense on the timeline from people that actually do not understand how all of this works.
So let me phrase it once and forever:
AI does not magically find smart contract bugs. Anyone selling that narrative is either clueless or deliberately pushing bullshit.
Modern models are getting better, and yes, if you throw a basic Solidity codebase into an AI and ask it to find issues, it may catch some obvious pattern-matching problems. But those are usually not the bugs that matter anymore. Serious protocols are not getting broken because of textbook vulnerabilities that every scanner, junior auditor, and LLM can already recognize.
The real value of AI in smart contract security is not “press button, find bug.” That is fantasy.
Good security researchers use AI to aggressively explore codebases, map complex control flows, identify hidden execution paths, and reason through unhappy paths that are easy to miss manually. AI becomes powerful when it is used by someone who actually understands auditing, knows what to ask, and has a proper harness around the model.
A strong researcher plus a strong model plus a strong audit workflow can absolutely find high-impact bugs. But without the researcher, without the methodology, and without the right setup, AI is just another tool producing noise.
So no, Mythos or any other model will not suddenly “find all the bugs.” That idea is nonsense. The future of Web3 security is not AI replacing auditors. It is highly competent auditors using specialized AI systems to go deeper, faster, and harder than manual review alone ever could.
@jcltdcrypto the line between pre AI and post AI security is going to become very clear, once this wave of hacks burns through the space, DeFi should come out of it in a much safer place
Right on cue
Zcash just patched a bug in its Orchard circuit, live since 2022, that could have minted undetectable counterfeit $ZEC. Some of the most scrutinized crypto in the space. 4 years invisible
@DefuseSec found it in days with Anthropic's Opus 4.8
The code didn't change. The cost of looking did
@0xCharlesWang@bailsecurity I can personally confirm all of this, and honestly much more lolol
I’ve been working with Bailsec since 2024 and I wouldn’t trust anyone else
had multiple moments where I literally thought: imagine what could’ve happened if I hadn’t relied on them
Ok let’s be very clear about the state of web3 security.
I’m here since 6 years now and I’ve experienced and seen most hacks and in fact, most of the hacks were pretty dumb and simple.
However, the last two hacks were extremely sophisticated and targeted vulnerabilities outside of smart contracts which required a planning and scheduling which is beyond anything imaginable.
And no, this is not because of:
„MyThoS hacKs EverYOne!!!“
Lazarus is increasing their resources to target protocols and new hacks become as carefully planned as advanced bank robberies. They don’t show any mercy and don’t expect there will be any negotiations. They are more rough than ever!
Ladies and gentlemen, we have arrived at a new stage of web2 and web3 security and it will become only harder to protect protocols at this point.
Blaming crypto because MetaMask takes almost 1% of your crosschain transfer is like blaming the Internet because you chose a bad provider.
In the banking system, you only see 1:1 because the transfer cost is often charged separately.
More than criticism, it is technical ignorance.
I see so many dexes launching... jumping chains without improving their model, and ngl if i can make some gains im all for it.... short term.
If tokenomics are the same its just heading in the same direction as the last. Even quicker as users become more savvy.
Make sure you take profits guys!