In a September 16, 2026 statement, Ethereum co-founder Vitalik Buterin argued that artificial intelligence can strengthen defensive engineering even as it gives attackers faster ways to find weaknesses. The same capabilities used to discover vulnerabilities could help defenders prove that critical software satisfies clearly defined security properties.
Formal verification is the center of the argument
Buterin framed cybersecurity as potentially defense-favoring once engineering practices improve. In his view, an AI system capable of proving difficult mathematical statements should also be able to assist with proofs about software behavior. That points toward formal verification: expressing a desired property precisely, then checking whether a program meets it.
The important caveat is that “secure” is not one property. A messaging system might keep content confidential yet still permit forged messages, denial of service, metadata leakage or failures caused by a compromised server. A wallet can use sound cryptography while remaining vulnerable through its operating system, software supply chain, database, interface or key-recovery process. Proving the wrong definition would produce confidence without covering the real threat model.
That distinction is particularly relevant to Ethereum. Smart contracts can be compact compared with conventional applications, but they interact with price feeds, bridges, governance systems, privileged keys and external protocols. A proof covering one contract does not automatically validate every dependency or the economic assumptions surrounding it.
AI can help both sides of the security contest
Attackers can use models to review code, automate reconnaissance and tailor social-engineering messages. Defenders can use related tools to inspect changes, generate tests, compare implementations with specifications and investigate incidents. The outcome therefore depends on more than raw model capability. Access controls, upgrade procedures, dependency management and incident response still matter.
Buterin’s argument also shifts attention from finding individual bugs to validating systems. That is a harder task because failures often occur at boundaries: between a contract and an oracle, between an application and a browser wallet, or between a user and a fraudulent interface. Useful verification must represent those boundaries rather than treating code as isolated.
What Ethereum users and builders should take from it
For builders, AI-assisted review should complement—not replace—independent audits, constrained permissions, staged deployments and monitoring. Specifications must describe who can change a system, what happens when a dependency fails and which recovery actions are possible. Where formal proofs are practical, their assumptions should be published with the result.
For users, the argument is not a promise that funds are safe. It is a reason to evaluate how a protocol manages keys, upgrades and dependencies instead of assuming that an “AI-audited” label settles the question. Better defensive tools can narrow risk, but only when teams define the full problem they intend to solve.
Sources & further reading
- Primary statement, September 16, 2026: Vitalik Buterin on X
- Adapted from BTC-Pulse: Vitalik Buterin Rejects AI Hackers Unwinnable Cybersecurity