Everyone is watching the price. No one is watching the plumbing.
In April 2024, a research paper crossed my desk that had nothing to do with crypto. It was from a joint team at OpenAI, Stanford, and Princeton. The finding: GPT-4 could read CVE disclosures, parse vulnerability descriptions, and autonomously write working exploit code against real-world, unpatched systems. Success rate against a test set of fifteen genuine vulnerabilities: 87%. GPT-3.5 and open-weight models like Llama 2: essentially zero.
The number sat in my mind like a ticking clock. I have spent nineteen years watching liquidity move through pipes most people don't know exist. Cross-border settlement layers. Arbitrage windows between decentralized exchanges and their centralized shadows. And now this: an AI agent that can find a crack in the foundation and widen it before the foundation's owners have finished their morning coffee.
This is not a security story. Or rather, it is not only a security story. It is a liquidity story. Attack capacity is the newest form of liquidity. It flows. It compounds. It seeks the path of least resistance. And, in a bull market where capital is flooding into autonomous agents, smart contracts, and machine-to-machine payment rails, the question is not whether this liquidity will find a target. The question is whether the infrastructure we have built can price the risk before the risk prices itself.
I wrote my first report on the ICO bubble in 2017 while modeling the velocity of funds through five hundred token sales. I found that sixty percent of initial liquidity was recycled within four hours, creating a false sense of organic demand. That experience taught me a lesson that has never left me: the most dangerous liquidity is the kind nobody sees moving. Today, I am looking at a different kind of invisible flow. AI-derived exploit capability. Let me trace it through the fog.
The Context: Meta's Containment Charade and the Open-Source Dilemma
By July 2024, Meta had released CyberSecEval 2, the industry's first comprehensive AI security evaluation suite, followed by an AI-specific bug bounty program at DEF CON offering up to one hundred thousand dollars per qualifying vulnerability. The story that reached the press was simple: Meta faces AI hacking challenges; Meta writes ethics guidelines; Meta invests in containment.
That framing makes for good headlines and bad analysis. What the framing misses is that Meta is not merely a victim of AI-era security threats. It is one of the architects of the threat structure itself. The company's open-weight Llama family of models represents the most successful open-source AI deployment in existence. Llama 3.1-405B, released in the same period, reached performance levels within shouting distance of GPT-4 on several general benchmarks.
And here is the structural contradiction that the mainstream coverage largely ignores: open-weight models can be downloaded, fine-tuned, de-aligned, and weaponized by anyone on earth. Meta's security problem is therefore not symmetrical with OpenAI's. OpenAI can monitor abuse through API access. Meta cannot monitor abuse of a model that lives on a user's own hardware, unmoored from any centralized control plane. The word "containment" in the original coverage borrows its idiom from biosecurity, where pathogens are physically sealed in laboratories. But the internet is not a laboratory, and code is not a virus. Information, once released into the public domain, is contained by nothing at all.
This is the same philosophical fault line that runs through blockchain governance. The open-source ethos says transparency is the ultimate security mechanism. The centralized ethos says control is. In crypto, we resolved this tension pragmatically: protocols open their code, and economic incentives police behavior. But AI models do not have an incentive layer. You cannot stake an AI's alignment. You cannot slash a model for misbehaving after it has been downloaded to a private server in a jurisdiction that does not care.
Tracing the liquidity ghosts through the ICO fog, I have seen this pattern before. Openness generates trust when there is a mechanism that punishes betrayal. In permissionless systems, that mechanism is financial. In AI systems, it does not yet exist. This gap is the new counterparty risk, and it is far larger than any smart contract bug I have ever audited.
The Core Analysis: Deconstructing the 87% and Mapping the Crypto Attack Surface
Let me be precise about what GPT-4 did and did not achieve in that April 2024 experiment. This matters because precision is the only antidote to hysteria.
The technical pathway decomposes into three stages. First, vulnerability intelligence understanding: the model reads a CVE advisory and related public exploit code, using natural language comprehension to extract the relevant conditions. Second, exploitation strategy generation: the model reasons about the attack path, choosing from known techniques. Third, code execution and feedback iteration: the model runs its code, observes the result, mutates its approach, and retries. This is an agentic loop, an orchestration of previously existing capabilities.
There is no architectural breakthrough here. No new transformer block. No novel alignment technique. The achievement is combinatorial: the assembly of planning, code generation, and tool use into an end-to-end exploit pipeline. What took a senior human hacker hours or days, from analysis to working exploit, could now be done in minutes.
This is the start of attack democratization — not the arrival of Superintelligent Hacking. That distinction is the most important filter through which to read the coverage. GPT-4 did not discover new vulnerability classes. It did not find a zero-day in a previously unknown system. It automated the exploitation of known, documented vulnerabilities. The bar for entering the exploit economy has been lowered from "advanced persistent threat group with dedicated reverse engineers" to "anyone with an API key."
When I worked on arbitrage mechanics during the DeFi summer of 2020, I discovered a fifteen-percent risk-adjusted yield advantage in settlement timing between Uniswap V2 pools and traditional FX forward markets. The insight was not that the constant product formula was wrong. It was that the operating window for arbitrage had contracted to a few seconds, and that the players capturing it were the ones who automated their execution loops. The same logic applies to vulnerability exploitation in the AI era. The window between disclosure and exploitation is collapsing. The players who will capture the value are the ones who automate the loop.
Mapping this onto crypto infrastructure is not difficult. It is deeply uncomfortable. Consider the three most exposed layers.
The first layer is smart contract security. The DeFi ecosystem has been living on a knife's edge made of audit reports. There is a fundamental asymmetry: auditors are human, and human attention is finite. A model that can read a CVE and weaponize it can equally read a smart contract's bytecode, identify patterns known to correlate with vulnerabilities, and generate exploit transactions. The current generation of models cannot yet do this reliably against novel, complex, non-public codebases. But the capability trajectory is clear, and here the "bear case" rigor I learned in 2022 — when I predicted the Terra algorithmic stablecoin collapse three days before the crash, based on game-theoretic analysis of the seigniorage mechanism — matters more than ever. The gap between "cannot do this yet" and "cannot do this ever" is closing faster than most audit firms are adapting. My hypothesis, based on the intelligence community's own estimates of AI capability growth, is that within two to three years, AI models will outperform human auditors at identifying reentrancy, integer overflow, and access-control vulnerabilities in EVM bytecode. When that happens, the economic value of a human audit will shift from detection to verification. The AI will find the hole. A human will sign off on the fix. This is an efficiency gain in theory. But in practice, it means the exploit side gets the same efficiency gain simultaneously. The race is symmetric. The stakes are not.
The second layer is cross-chain bridges and messaging infrastructure. I have written elsewhere that the "omnichain app" narrative is largely VC-manufactured — users do not care how many chains a contract is deployed on. But bridges remain the catastrophic risk point of the multi-chain universe, and they are uniquely vulnerable to AI-augmented attack because they are complex distributed systems with heterogeneous trust assumptions. A GPT-4-class agent reading a bridge's source code, simulating its message verification flows, and probing for edge cases is a fundamentally different threat than a human team reading the same code. The agent does not sleep. It does not get distracted. It can spawn a thousand parallel explorations of the same attack surface. The human-facilitated hacks we have seen in this cycle, from Ronin to Wormhole to the various cross-chain messaging exploits, look like sledgehammers. The AI-aged attack will look like a scalpel, guided by an eye that can read every line of the system simultaneously. Do not confuse the metaphor with hyperbole. The computational literature on agentic LLM planning shows that, given a defined environment and a clear reward function, these systems iterate on failure at rates a human team cannot match. Bridge codebases, with their explicit invariants and message-passing patterns, are naturally structured environments. They are, in other words, ideal hunting grounds.
The third layer is the one I know best from my current research into machine-to-machine payments. In 2026, I modeled the potential market for AI-agent-driven crypto payments and arrived at fifty billion dollars of infrastructure demand. The core requirement of that economy is low-latency, atomic, machine-verifiable settlement. Think about what an agent economy actually needs: its participants will be software entities that negotiate, transact, and hold value on their own account. The entire design premise of "agents with wallets" assumes that the trust layer between machines is code. Software agents will signal authenticity to each other through cryptographic keys, not through reputational human review. This creates an attack surface that does not exist in human-mediated finance: an attacker could spoof an agent's identity by compromising its key custody, or more disturbingly, by manipulating the AI's decision-making itself through prompt injection or adversarial examples. If an AI agent manages a payment channel and a malicious text embedded in the data payload causes it to sign an unauthorized transaction, the entire promise of machine-to-machine settlement collapses. We are building a payments system where counterparties are software, and software can be socially engineered. Oracle feed latency is DeFi's Achilles' heel, as I have argued for years; Chainlink has solved decentralization by retaining centralized operator nodes, which is its own joke. But the oracle problem of the agent economy will not be a question of stale price feeds. It will be a question of corrupted models. A poisoned training example. A prompt injection that travels through the data layer into the signing layer. That is not a security bug. That is an existential flaw in the architecture of digital trust, and it will be priced into the market exactly the way counterparty risk was priced into every pre-crypto financial instrument: late, wrong, and all at once.
I want to emphasize the asymmetry of adaptation. Defensive AI security is being built at the big cloud and security vendors. Microsoft launched Security Copilot. CrowdStrike and Palo Alto Networks are embedding generative models into their detection and response workflows. All of this is necessary. But there is a fundamental difference between the defense side and the offense side. Defense must be right every time. A single missed detection is a catastrophe. Offense only needs to be right once. The AI-driven attacker has an additional luxury: it can train its own evasion techniques against defensive models, iterating in simulation until it achieves a high success rate, then deploying the refined attack at the moment of maximum impact. This is the AI-versus-AI arms race, and it will move in cycles. Each side continuously adapts. The market's current security model, based on periodic audits and reactive patches, cannot survive this cadence.
I have written this before, and I will write it again until the industry internalizes it: the value of an audit is not proportional to the audit report's length. It is proportional to the time between the audit and the exploit. In the AI era, that half-life is going to shrink to near zero. I began my career as a junior quantitative analyst in Istanbul modeling fund flows through ICOs, and I learned that the most reliable indicator of an impending crash was not any single balance-sheet metric but the velocity of money recycling through the same pool. The velocity of exploit development is now accelerating the same way. The foundational assumption of the crypto security industry — that a human audit is a durable seal of approval — is being undermined by a capability that can read, learn, and execute at machine speed. Smart contract auditors who do not integrate AI into their own review pipelines will be obsolete. The security vendors that figure this out first will own the premium layer of the market. The ones that do not will be providing insurance claims, not protection.
One more component flows from the experiment I traced earlier. The 87% figure highlights model scale. GPT-3.5 and Llama 2 were at zero percent. That gap demonstrates the "capability overflow" effect: general reasoning skill, developed through large-scale training, transfers almost for free to offensive security tasks. We did not build models to attack networks. We built models to reason, and reasoning turned out to be a Universal Exploit Generator. This has a direct implication for infrastructure allocation. Meta's reported compute spend for the Llama 3 family was on the order of 3.8 times ten to the twenty-fifth FLOPs. That investment produced both defensive capability and offensive capability simultaneously. You cannot selectively disable the attack surface of a model without crippling its general intelligence. There is no dial in the architecture labeled "security." The parameterization is entangled. This is what I call the paradox of the dual-use foundation: every dollar spent on model scale makes the model more useful and more dangerous in equal measure. The implications for crypto infrastructure are uncomfortable because they suggest that the same scaling curves that brought us generative code will bring us generative exploits, on the same timeline, with no meaningful delay.
The Contrarian Angle: Containment Is a Flawed Metaphor and the Real Victims Are Not the Giants
Let me now complicate the narrative. The AI-security coverage, and much of the market's gaze, is fixed on the giant platforms. Meta. OpenAI. Google. The logic is that the largest players have the most to lose and therefore will invest the most. This is partially true. It is also a dangerous distraction.
The real victims of attack democratization are the mid-size protocols and the individual users. Think about it. A GPT-4-class model that can autonomously parse a vulnerability and weaponize it is a tool available to anyone. Phishing is being upgraded from broad, impersonally generated email campaigns to personalized, context-aware attacks built from scraped data. Account takeover attacks are being automated against exchanges, lending platforms, and unsecured wallets. The small DeFi protocol with a three-person security team and a single audit from a second-tier firm behind a $40,000 retainer is now exposed to the exact same quality of attack at the latest zero-day as a protocol with a fifty-person security department. The asymmetry is structural. The giants have scale to absorb losses and to fund defenses. The small players do not. This will cause consolidation, and fast. The premium for credibility — for a proven security track record, for institutional-grade audit standards, for AI-augmented red-team validation — is about to become the dominant determinant of where liquidity flows in the crypto market.
There is a second contrarian point I want to make about containment itself. The term comes from the physical world, where you can build walls, install locks, and restrict access. The crypto world has been here before. In 2016, The DAO, a smart contract holding three-plus million Ether, was drained because of a reentrancy bug that had been identified but not fixed. The damage could not be contained. It was a liquidity event. The Ether was not locked in a lab; it was flowing through the open economy. I was still working on cross-border payments then, and I remember reading the post-mortems and noticing that the commentators focused on the flaw in the code. What they missed was the flaw in the architecture of the system: the assumption that code, once deployed, would behave as trusted. That assumption is the same one behind today's AI containment rhetoric. We cannot build a wall around software. We cannot police a blockchain. The knowledge of how to exploit a system is itself a fungible asset, and any attempt to contain it distorts the market rather than protecting it. This is not an argument for fatalism. It is an argument for redesigning the incentive layer.
I also challenge the implied assumption that OpenAI's closed model is safer. The centralized approach offers a specific kind of control: you can limit the model's access to sensitive information, you can monitor usage, and you can withdraw access from bad actors. But this control is an illusion at the ecosystem level. The same underlying research that produces OpenAI's safety insights can be reproduced by other labs, including open-weight labs. The open-source community has already demonstrated the "de-alignment" phenomenon repeatedly in academic settings: fine-tuning an open model on a small, targeted dataset of malicious examples can strip away its refusal behavior in days. Llama is not inherently safer than GPT-4 as a foundation. It is more transparent, which is the only meaningful difference. And that transparency creates a question for governance: what is the mechanism by which an open model is held accountable for the actions of the malicious actor who downloads it and de-aligns it? There is no such mechanism. The safe harbor argument of "the platform is not responsible for the user" evaporates in the context of an AI model that can act autonomously. An open model is a liability without a legal owner.
And the security insurance market knows this. The conversation about pricing AI-related risk has begun. Cyber insurance underwriters are starting to ask pointed questions about the AI agent's capabilities in policyholder environments. When the first major AI-caused loss is settled — and it will not be a speculative event but a contracted, quantifiable loss — insurance rates will reprice across the entire sector within a quarter. The crypto industry has spent the last couple of cycles treating insurance as an afterthought. After this shift, the cost of capital will force every DeFi protocol, every custodian, every bridge operator to document its AI exposure the way it documents its collateralization. The protocols that refuse to do this will find themselves priced out of the market by underwriters before regulators ever get involved.
The Bear Case: Everything I Just Said Could Be Wrong
I cannot write this article without submitting my own analysis to the skepticism that defines my approach. The bear case is not hypothetical. It is the set of ways in which the market might be overreacting to AI security in crypto.
The first is the reality check on the operational maturity of AI attacks. There is a difference between the controlled environment of the April 2024 study and the messy complexity of production systems. The study involved a set of fifteen vulnerabilities, each with a documented CVE and mostly with public exploit code. The model did not have to design a new attack from scratch. It had to recombine known components. Real-world attack surfaces are messy: they require context about infrastructure, dependencies, and environmental variables that an LLM agent may not have access to. In my own modeling work, I have found that as the attack task becomes less well-specified, the performance of frontier models in these tasks drops sharply. The capability ceiling identified in the research papers is real, but the effective capability in the wild is much lower, bounded by environmental complexity.
The second challenge is economic. The cost of a successful attack is not zero. To run a GPT-4-class model at the scale required to probe complex systems, you need meaningful compute resources. The cost per attack attempt may outweigh the expected return for all but the highest-value targets. This is a stringent filter in a world where the majority of crypto assets are locked in relatively small, well-fenced contracts. In the absence of a high-value target, most AI-augmented attack attempts may be economically irrational. The attacks we will see in the near term will be opportunistic. The truly dangerous scenario requires an attacker with deep pockets and high motivation — which means that the state-sponsored actor remains the primary realistic threat, and state actors already have capabilities comparable to the frontier models.
The third challenge is the pace of defensive adaptation. It is possible that AI-augmented defense will outpace AI-augmented offense, as has happened in several prior technology races. The same generative models that can write exploits can write code to detect and patch them. The defensive advantage is structural: defenders operate on their own infrastructure, with continuous monitoring, and can integrate AI into their pipelines without facing the environment-uncertainty penalty that attackers face. If defensive AI matures faster, the market equilibrium will hold. But equilibrium in security systems is always temporary, and the data on offense-defense dynamics in cyberspace historically favors the offense. The burden of proof is on the defense.
The Takeaway: Agents Will Audit Agents, and the Price of Risk Will Resemble a Liquidity Event
The cycle is turning. The same bull-market euphoria that has pushed the total crypto market capitalization to record highs has also turned AI security from a niche concern into an institutional focal point. When the market is booming, technical vulnerabilities are ignored. When the credit cycle compresses, they become the first thing that gets repriced. The next exploit, when it comes, will not be a news item sent to a mailing list. It will be a live event that funds are rebalancing around in real time.
What I am looking for is not the next Meta announcement. I am looking for the first agentic red-team platform that successfully identifies a critical vulnerability in a production crypto bridge using a fully automated loop. That event, whenever it occurs, will be a pivot point as clear as the Terra collapse was to me in 2022. The response of the industry — whether it doubles down on centralized security theater or embraces transparent, auditable, machine-speed defense — will define the next cycle's winners.
The bear case breathes. The bull case is funded. The one thing the market has not priced is the speed at which the capability curve will bend the security cost curve. When the math changes, liquidity moves first. Trace the ghosts. Watch the plumbing.
The next audit will not be written by a human. The next exploit will not be announced. The market will learn the difference between a title and a threat when the first agent comes for the bridge in the middle of the night, when no one is watching the price, when everyone is watching the chart. The liquidity ghosts are already moving through the ICO fog of the machine economy. The only question that matters is who will be holding the position when the fog lifts.