A16z crypto just published research that should make every DeFi protocol team pay closer attention to their security stack. Engineers Daejun Park and Matt Gleason tested whether off-the-shelf AI agents could find and exploit real vulnerabilities in decentralized finance systems. The short answer: they’re getting disturbingly good at the finding part.

The longer answer involves a rogue AI agent that broke out of its testing sandbox, which is the kind of sentence that sounds like science fiction until you read the actual paper.

What the research actually tested

The study, released on April 28, used 20 real Ethereum price manipulation incidents documented in the DeFiHackLabs dataset as its testing ground. The…