The arrival of Mythos, an AI system built to autonomously find code vulnerabilities, is prompting a wider debate in crypto: how much security review should be expected before smart contracts go live. Researchers say AI-driven tooling is making bug discovery cheaper, faster and much harder for teams to ignore, which could shift the industry’s idea of reasonable due diligence.
Smart contract security has long been limited by cost. Full audits are often expensive, leaving many projects to narrow the scope of reviews or skip them altogether. Alexander Urbelis, chief information security officer at ENS Labs, said systems such as Mythos are pushing the price of a basic audit toward zero. Work that once took weeks and demanded meaningful spending could eventually be completed in minutes, opening the door for smaller teams to get fast security assessments.
From automated bug hunting to reasoning about code behavior
Security researchers have used fuzzers for years, feeding programs large volumes of inputs to see what breaks. AI systems differ from that approach. Urbelis said machines have been hunting bugs for a long time, but the current shift involves fuzzers with the capacity to reason.
Instead of only spotting technical flaws, tools like Mythos may infer what code was meant to do and compare that intent with actual behavior. In crypto, that matters because smart contract code is usually public and bug bounty programs can carry large budgets. If AI can detect mismatches and vulnerabilities before deployment, it expands the industry’s capacity to catch problems earlier.
Continuous auditing may matter more than one-off reviews
David Schwed, COO of blockchain security firm SVRN and founder of the cybersecurity master’s program at Yeshiva University, said the larger change may be continuous security monitoring rather than vulnerability discovery alone. In his view, the key shift is that projects could get ongoing audits and suggested fixes at a fraction of the old cost, instead of paying for a single point-in-time review.
If reviews become inexpensive and continuous, expectations may move with them. Urbelis said AI could eventually reshape the standard of care in smart contract development. Teams have historically pointed to the cost and complexity of audits to explain why some checks were not done. That defense gets weaker if sophisticated analysis is available on demand. He added that a clean AI report may not serve as a defense in future disputes; the opposing argument could be that the tool existed, it was affordable, and the issue should have been caught.
Human auditors are still needed
Neither researcher said AI is ready to replace human auditors. Urbelis noted that machines are strong at finding coding flaws but weaker at identifying economic and incentive-based vulnerabilities, the kind that have contributed to some of crypto’s largest losses. Bugs that empty treasuries often hinge on intent and adversarial incentives, and those judgments still require experienced people.
Schwed offered the same caution from another angle. Asking a large model to audit a smart contract and make no mistakes is not a security program by itself. If the person using the tool cannot assess the output, the result is not real security but a false sense of security. That leaves a practical question for projects and investors: if AI-assisted reviews become common, will funding and deployment increasingly assume those checks have already been done?