AI Found 120% More Bugs in Crypto Code. Now Comes the Part Nobody Wants to Underwrite

I've seen this movie before. A shiny new tool shows up, everyone points at the productivity chart, and nobody asks the boring question. Who's holding the bag when the queue gets longer than the people clearing it?

That's where we're with AI in security research. A preprint tied to Project Glasswing looked at firms that wired AI into their disclosure pipelines and found they surfaced roughly 120% more flaws. Measured fix rates held up. No detected slowdown in repairs.

Everyone agrees on the headline. That's the problem.

What that 120% is actually counting

Start with the mechanics, because this is where most coverage stops.

AI scanners are pattern machines. They're excellent at grinding through a codebase and flagging anything that resembles a known bug class. Reentrancy shapes. Missing access checks. Unbounded loops. Input validation holes. The stuff that has a signature.

What they're less good at is the stuff that kills protocols. Economic design flaws. Oracle assumptions that break at 3am on a Sunday. Incentive structures that look fine in a tabletop review and fall apart the moment someone with real capital leans on them.

So you get a 120% lift in findings, and a big slice of that lift lands in the shallow end of the pool. That's not nothing. Shallow bugs still drain wallets. But it's not the same as a 120% lift in the bugs that cause nine-figure bridge failures, the kind we watched in 2022 when Ronin lost about $624 million and Wormhole lost roughly $320 million.

Here's the number that should make you pause. Fix rates "kept pace" with a discovery rate that doubled. Read that again. Pace is relative. Pace against what? If a team used to close 60 findings a quarter and now closes 130 out of 220, the ratio looks fine and the absolute pile of open items is bigger than it's ever been.

The paper is honest about the gap, which I respect. It flags hidden backlogs and says the attack prevention question is still open. That's the whole story, and it's buried in the caveats.

If your tool finds twice as many bugs and half the new ones are severity-inflated reclassifications, you haven't doubled your security. You've doubled your paperwork.

And the paperwork has a cost. Triage burns senior engineer hours. Every false positive that gets escalated pulls someone off the thing they were actually building. Ask any protocol founder who's been through a two-week audit cycle what their calendar looked like.

Who wins and who eats the loss

Pull the camera back and this stops being a security story. It becomes a pricing story.

Audits in this sector have always been part badge, part substance. A routine smart contract review typically runs somewhere between $30,000 and $150,000 depending on scope, and a lot of buyers were really purchasing the logo on the landing page. "Audited by" became a marketing asset, not a risk document.

AI breaks that model in a useful way. When scanning gets cheap and fast, the value migrates from the scan itself to the judgment on top of it. Anyone selling a scanner is selling a commodity now. The shops that survive will be the ones that can look at 400 AI-generated findings, throw out 340 of them without losing credibility, and correctly rank the 60 that matter.

That's a harder business. Fewer firms can do it. Expect consolidation and expect pricing pressure on the bottom half of the audit market. If you own equity in a small boutique shop whose entire pitch is "we run Slither and write a PDF," this report is a slow-motion margin call.

Bug bounty platforms are the quiet winner. More findings means more triage demand, and bounties scale with a percentage of the value at risk, not with how many lines of code got scanned. That's a much better business than hourly consulting.

And then there's the group nobody talks about. Token holders.

If you hold a governance token in a protocol that's been running the same unaudited periphery contracts since 2023, the AI wave doesn't make you safer this quarter. It makes the eventual disclosure more likely and more public. Hidden backlogs have a way of becoming visible at the worst possible moment, usually right after a governance vote.

What if the opposite is true, though? What if the 120% number is actually the bearish signal for the security-industrial complex? If AI finds the easy stuff for free, the going rate for finding easy stuff goes to zero, and the market is forced to pay only for the genuinely hard work. That compresses an entire cottage industry that's been coasting.

What I'd actually do with this

Stop reading the audit badge. It's a lagging indicator that measures a moment in time and tells you nothing about Q3.

Read the changelog instead. Any serious protocol publishes its fix history somewhere, whether in a Gitcoin-style bounty log, a security page, or a public repo. A team that ships patches every three weeks is a different animal from a team that shipped one audit in 2024 and has been coasting on it since.

Second, watch for severity inflation. If a team suddenly announces a huge jump in "issues identified" with a corresponding jump in "issues resolved," ask who set the severity labels. AI-assisted audits are notorious for generating informational-level noise that gets counted into a resolution rate to make the graph look good. That's not fraud. It's just how the metrics shake out. But it's not security either.

The consensus trade is crowded right now. Everyone's buying the "AI makes crypto safer" narrative because the discovery number went up and the fix number went with it. But the paper itself says attack prevention is unresolved. That's the honest sentence in the whole document, and it's the one the crowd is skipping past.

So here's my position. The finding side of this trade is real and it's a genuine improvement. The fixing side is a capacity problem that AI hasn't solved, and the industry is doing what it always does. Celebrating the input metric and hoping nobody audits the output.

When the crowd panics, I sharpen my pencil. Right now the crowd isn't panicking. It's patting itself on the back.

That's usually when the bill shows up.