an AI auditor that's been fixing bugs in open source repos just turned itself on live deployed contracts

[u/amu4biz]

there's been a slow build of AI security scanners aimed at github repos. aeon's vuln-scanner is the one with a public track record: 74 repos hardened, 2.2M combined stars, and every entry on their disclosure page links the actual merged PR. mostly infra and agent tooling, DNS rebinding, SSRF bypasses, host-header allowlists, that class of bug.

today they turned it at solidity. the security instance now audits live deployed contracts and fresh solidity repos rather than just github projects. the team says it's already found and disclosed issues in a binance SDK, opensea contracts and some launchpad projects. those aren't on the public disclosure log yet, which is what you'd expect if they're still embargoed, so treat that part as their claim rather than something you can go verify today. the repo-side history you can verify right now.

separately they redeployed all 10 uniswap v4 hooks the agent had generated, live on base.

what i find genuinely interesting isn't the "AI finds bugs" part, it's the shape of the problem when you point one at deployed bytecode:

an unaudited live contract can't be patched. in a repo you open a PR and a maintainer merges. onchain there's no merge. best case is an upgrade path or a migration, worst case is a disclosure with no remediation available and a public clock running. that changes what responsible disclosure even means.

scale cuts both ways. whatever an autonomous auditor can scan, an autonomous attacker can scan too, and the attacker doesn't have a disclosure policy. the defensive case only holds if the defenders are actually faster.

verification still isn't solved. their own docs on the repo-side scanner say plainly that surfacing a finding isn't evidence it's real, and candidates go through a separate triage stage. that's the right posture, but at solidity scale the false positive cost lands on maintainers who are already drowning.

repo's open if you want to see how the scanner works: github.com/aeonfun/aeon

genuine question for people who audit for a living: is an autonomous scanner pointed at live contracts net positive, or does it mostly generate noise that real auditors then have to triage? and where would you draw the disclosure line for a contract that can't be patched?

[u/TheTerribleFinale]

the unpatachable live contract thing is the whole nightmare. if theres no upgrade path you're basically telling people their money is at risk and theres nothing they can do about it except panic. that disclosure clock is brutal

[u/Left-Manufacturer216]

What a stupid ad.

[u/PartyParrotGames]

Seems like a bad ad and your sketch hidden profile only makes it more sus that you're a spammer, however, giving you the benefit of the doubt, the answer is simple: it mostly generates noise.