AI Models Emerge as Powerful Tools for Uncovering Software Vulnerabilities, Raising Security Alarms
The latest generation of advanced artificial intelligence models are moving beyond conversational tasks, image generation, and code writing. Researchers are increasingly leveraging systems like Anthropic’s Claude Mythos and Claude Opus 4.8, alongside OpenAI’s GPT-5.5, to identify software vulnerabilities. This development is sparking concerns about the implications of such capabilities becoming widely accessible.
Crypto investors received a stark reminder of the growing threat posed by powerful AI this week. Zcash developers revealed that Claude Opus 4.8 was instrumental in discovering a critical vulnerability. This flaw could have allowed an attacker to mint an unlimited supply of ZEC. However, due to the network’s design, it is impossible to definitively confirm if counterfeit ZEC was indeed minted, a situation that contributed to a significant price drop for ZEC late this week.
Experts caution that as AI software becomes more sophisticated and accessible, a surge in discovered vulnerabilities is likely in the coming weeks and months. This trend is already making its mark on the cryptocurrency landscape.
From Coding Assistants to Security Detectives
Initially, early AI models served as professional coding assistants, aiding developers in writing, explaining, and debugging software. As the technology matured, researchers began employing these same systems for code review, software auditing, and vulnerability research.
This evolution from a coding assistant to a security tool coincided with a broader shift in AI’s role within software development. Following the launch of Claude Code in 2025, Anthropic reported a substantial increase in AI-generated code across its engineering teams, signaling a move from models that merely suggested code to systems capable of writing and executing it.
Security professionals emphasize that the impact extends beyond assisting developers.
“AI is far better at reviewing code than most people and finding potential vulnerabilities in it,” Danny Jenkins, CEO and co-founder of ThreatLocker, told Decrypt. Jenkins noted that current AI systems are already accelerating vulnerability discovery, and newer models like Mythos could dramatically enhance these capabilities, describing it as an imminent “big problem.”
“It will be only a matter of time until someone bad gets access to it,” he added.
Jenkins further explained that AI is lowering the barrier to entry for vulnerability research, enabling more individuals to analyze code, pinpoint weaknesses, and develop exploits. As access to increasingly powerful systems expands, he anticipates an accelerated pace of vulnerability discovery.
“Pre-AI, cybersecurity threats and exploits were increasing every year,” Jenkins stated. “Post-AI, it’s become even faster, and I think it’s become faster for two reasons. One is that you can now use AI to help find vulnerabilities and exploits, and the number of people who have the ability to do this has massively grown. You don’t have to be a script kiddie now.”
Expanding Access and the Race for Defense
As AI systems grew more capable, companies began integrating them into cybersecurity efforts. On Tuesday, Anthropic expanded access to Project Glasswing, granting 150 companies and institutions the ability to use Claude Mythos to identify and remediate software vulnerabilities before the model’s wider release.
In April, Mozilla disclosed that Anthropic’s models had helped identify hundreds of vulnerabilities that were subsequently fixed in the Firefox web browser. Concurrently, researchers at Calif utilized Mythos Preview in their work, which led to one of the first public exploits targeting Apple’s M5 chips.
Stanislav Fort, a former researcher at Google DeepMind and Anthropic and now founder and chief scientist of security firm Aisle, acknowledged the validity of concerns surrounding AI-powered vulnerability discovery but suggested they are often misconstrued.
“The naive response is to try to gatekeep access to powerful models. I think this is essentially security by obscurity, and security by obscurity is one of the worst ideas in the field,” Fort told Decrypt. “The capability for zero-day discovery is already widely distributed across models that no one can restrict. Trying to bottle it up at the frontier doesn’t eliminate the risk; it just delays it while also slowing down the defenders who need these tools most.”
Fort highlighted a more significant risk: defenders, particularly open-source maintainers, may not have access to the same advanced AI tools available to attackers.
“That imbalance is the real danger,” he asserted. “The answer isn’t restriction; it’s democratization of the defensive stack.”
Anthropic is not alone in developing AI models for cybersecurity. In May, Microsoft introduced MDASH, an agentic vulnerability discovery system that the company claims helped identify previously unknown Windows vulnerabilities.
Crypto and DeFi Under AI’s Glare
The cryptocurrency and decentralized finance (DeFi) sectors are beginning to feel the impact of AI-driven bug hunting. Blockchain projects have long been attractive targets due to the substantial financial stakes and the public availability of much of their code. Jenkins predicts that as AI improves its ability to find software flaws, open-source crypto projects could become easier targets for both security researchers seeking bugs and attackers aiming to exploit them.
In a clear demonstration of how advanced AI models can uncover vulnerabilities that have eluded years of human scrutiny, independent security researcher Taylor Hornby disclosed the critical vulnerability in Zcash’s Orchard privacy pool, discovered with the assistance of Claude Opus 4.8.
The flaw had the potential to allow an attacker to create unlimited counterfeit ZEC and had gone undetected for years before being patched. It remains unknown whether the exploit was actually used.
“The vulnerability was present from Orchard’s activation in May 2022 until the emergency fix was deployed on June 1, 2026,” Shielded Labs, the organization behind Zcash development, stated in a disclosure. “Due to the privacy properties of Orchard and the nature of the bug, there is no definitive way to determine, using only cryptography, whether such exploitation occurred.”
This incident occurs as DeFi protocols are already experiencing one of their most challenging periods for exploits. Over $840 million was stolen from DeFi projects in the first five months of 2026, with April alone seeing over $600 million lost across attacks on projects including KelpDAO and Drift Protocol.
The rise of “vibe hacking,” where attackers use AI coding agents to automate reconnaissance, credential theft, malware development, and other tasks, has fueled concerns that AI is lowering the barriers to executing sophisticated cyberattacks.
Natalie Newson, senior blockchain investigator at Web3 security platform CertiK, noted that while April was exceptionally severe for crypto exploits, the broader trend remains more stable and below the peak number of incidents seen in previous years.
“April 2026 was a bad month for crypto exploits; there were only three days without an exploit in which at least $10,000 was taken,” she said. “However, when we take a look at the wider picture, the number of incidents (excluding phishing) has arguably been fairly consistent and still lower than a peak in 2023.”
While AI may be simplifying DeFi exploits, according to Blockaid CTO Raz Niv, the greater risk lies not in AI replacing hackers but in amplifying their capabilities. This allows attackers to focus on more advanced techniques while AI handles routine tasks.
“The good news is defenders can use the same tools,” Niv concluded. “AI-assisted monitoring and simulation is becoming essential for security teams trying to keep pace.”
