Key Takeaways
- • A16z crypto researchers Daejun Park and Matt Gleason published a study (April 28, 2026) demonstrating that AI agents can detect vulnerabilities across 100% of tested DeFi exploits, but execution success remains critically constrained at baseline performance levels.
- • Baseline AI agents achieved only a 10% exploitation success rate despite universal vulnerability detection, revealing a substantial gap between identifying security flaws and operationalizing them into functional attacks.
- • When provided structured domain knowledge derived from historical attack patterns, AI agent exploitation success surged to 70%—a seven-fold improvement—indicating that contextual knowledge of DeFi attack mechanics dramatically enhances execution capability.
- • AI agents exhibited consistent failure modes in complex economic logic, leverage calculations, and profit threshold optimization; agents particularly struggled when profit thresholds exceeded $10,000 but showed improved performance at $100 thresholds.
- • The study tested 20 real Ethereum price manipulation incidents from the DeFiHackLabs dataset using the Codex framework paired with GPT-5.4 and Foundry tools, establishing empirical evidence that AI is not introducing novel vulnerabilities but rather accelerating the identification and exploitation of existing weaknesses.
Summary
A16z crypto's research team has released findings that challenge the prevailing narrative around AI-driven DeFi security threats. Published on April 28, the study by engineers Daejun Park and Matt Gleason tested whether commercially available AI agents could identify and execute exploits against real decentralized finance vulnerabilities, ultimately revealing a more nuanced threat landscape than headlines suggest.
The researchers conducted their analysis using 20 documented Ethereum price manipulation incidents sourced from the DeFiHackLabs dataset. Using the Codex framework integrated with GPT-5.4 and Foundry simulation tools, they configured bare-bones AI agents with minimal specialized knowledge of DeFi attack patterns. Under these baseline conditions, the agents demonstrated an unexpected capability: they detected vulnerabilities in all 20 test cases without failure. This universal detection rate underscores how accessible modern AI systems have become at identifying security weaknesses in protocol code.
However, detection and execution diverge significantly. The baseline AI agents succeeded in pulling off actual exploits in only 10% of cases—a stark contrast to their perfect vulnerability identification rate. This performance gap is material for DeFi protocol teams assessing their exposure. The researchers then introduced structured domain knowledge into the agents' decision-making framework, essentially providing them with a synthesized playbook of real-world attack methodologies. This intervention produced dramatic results: exploitation success rates jumped to 70%, representing a seven-fold improvement over baseline performance.
The failures that persisted revealed important constraints on AI agent capabilities. Agents consistently stumbled on complex economic logic calculations, particularly when evaluating leverage mechanisms and economic variables critical to exploit success. Performance degradation was especially pronounced when profit thresholds were elevated to $10,000; lowering thresholds to $100 improved execution rates materially. These findings suggest that AI agents excel at mechanical code execution but struggle with the nuanced economic reasoning required in sophisticated DeFi attacks involving multiple variables and liquidity constraints.
The research validates a critical distinction for institutional investors and protocol developers: AI is not generating novel vulnerabilities but rather democratizing the identification and execution of existing weaknesses. The implication is that security teams cannot rely on obscurity or complexity as protective measures; instead, rigorous code audits, economic modeling, and real-time monitoring systems become essential defensive infrastructure against an increasingly capable attack surface powered by AI-assisted exploitation.
The researchers conducted their analysis using 20 documented Ethereum price manipulation incidents sourced from the DeFiHackLabs dataset. Using the Codex framework integrated with GPT-5.4 and Foundry simulation tools, they configured bare-bones AI agents with minimal specialized knowledge of DeFi attack patterns. Under these baseline conditions, the agents demonstrated an unexpected capability: they detected vulnerabilities in all 20 test cases without failure. This universal detection rate underscores how accessible modern AI systems have become at identifying security weaknesses in protocol code.
However, detection and execution diverge significantly. The baseline AI agents succeeded in pulling off actual exploits in only 10% of cases—a stark contrast to their perfect vulnerability identification rate. This performance gap is material for DeFi protocol teams assessing their exposure. The researchers then introduced structured domain knowledge into the agents' decision-making framework, essentially providing them with a synthesized playbook of real-world attack methodologies. This intervention produced dramatic results: exploitation success rates jumped to 70%, representing a seven-fold improvement over baseline performance.
The failures that persisted revealed important constraints on AI agent capabilities. Agents consistently stumbled on complex economic logic calculations, particularly when evaluating leverage mechanisms and economic variables critical to exploit success. Performance degradation was especially pronounced when profit thresholds were elevated to $10,000; lowering thresholds to $100 improved execution rates materially. These findings suggest that AI agents excel at mechanical code execution but struggle with the nuanced economic reasoning required in sophisticated DeFi attacks involving multiple variables and liquidity constraints.
The research validates a critical distinction for institutional investors and protocol developers: AI is not generating novel vulnerabilities but rather democratizing the identification and execution of existing weaknesses. The implication is that security teams cannot rely on obscurity or complexity as protective measures; instead, rigorous code audits, economic modeling, and real-time monitoring systems become essential defensive infrastructure against an increasingly capable attack surface powered by AI-assisted exploitation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.