Successfully simulated theft of $4.6 million. AI has now learned how to autonomously attack smart co

Anthropic, a leading AI company and developer of Claude LLM models, today announced results of a test involving the use of AI to autonomously attack smart contracts. (Note: Anthropic was previously invested in FTX. Its shares theoretically have significant value, which could have helped compensate for FTX’s asset losses. However, its assets were sold at a low price by the bankruptcy management team.)

The results of the test show that AI-based autonomous attacks that can be profitable and applicable in real-world scenarios are technically feasible. It should be noted that Anthropic’s experiments were conducted solely in simulated blockchain environments, not on actual chains. Therefore, these experiments did not affect any real assets.

Below, we will briefly describe Anthropic’s testing methodology.

Anthropic first developed a smart contract that utilized the SCONE-bench benchmark. This is the first such benchmark that measures the ability of AI agents to exploit vulnerabilities by simulating the theft of funds. This benchmark does not rely on reward systems or predictive models; instead, it directly quantifies losses and evaluates capabilities based on changes in assets on the chain.

The SCONE-bench benchmark uses a dataset consisting of 405 contracts that were actually attacked between 2020 and 2025. These contracts are located on Ethereum, BSC, and Base EVM chains. For each target contract, the AI agent running in the sandbox environment must use the tools provided by the Model Context Protocol (MCP) to attempt to attack the specified contract within a limited time frame of 60 minutes. To ensure reproducible results, Anthropic has developed an evaluation framework that uses Docker containers for sandboxing and scalable execution. Each container runs on a local blockchain with a specific block height bifurcation. Below are the test results obtained by Anthropic for various scenarios:

First, Anthropic evaluated the performance of 10 models including Llama 3, GPT-4o, DeepSeek V3, Sonnet 3.7, o3, Opus 4, Opus 4.1, GPT-5, Sonnet 4.5, and Opus 4.5 across all 405 benchmark contracts. Overall, these models generated exploit scripts that could be directly used to simulate the theft of $550.1 million.

Secondly, to minimize potential data contamination, Anthropic used the same 10 models to evaluate 34 contracts that were attacked after March 1, 2025. This time point was chosen because March 1 marked the latest knowledge cutoff date for these models. In total, Opus 4.5 and Sonnet 4.5 successfully exploited 19 contracts out of 34, with the highest simulated theft amount reaching $4.6 million. The best-performing model, Opus 4.5, successfully exploited 17 contracts, resulting in a simulated theft of $4.5 million.

Finally, to assess the ability of AI agents to discover new zero-day vulnerabilities, Anthropic tasked Sonnet 4.5 and GPT-5 with evaluating 2849 contracts that had been deployed recently and had no known vulnerabilities. 两个AI Agent各自发现了两个新的zero-day漏洞，并生成了价值3694美元的攻击方案，其中GPT-5的API成本为3476美元。这证明了——可盈利、现实中可复用的AI自主攻击在技术上已经可行了。

在Anthropic公布测试结果后，包括Dragonfly管理合伙人Haseeb在内的多位业内知名人士都在感慨AI从理论发展到实践应用的速度令人惊异。

但这个速度究竟有多快呢?Anthropic也给出了答案。

在测试结语中，Anthropic表示在短短一年内，AI在该基准测试中能够利用的漏洞比例从2%暴涨到了55.88%，可窃取资金也从5000美元激增至460万美元。Anthropic还发现，潜在的可利用漏洞价值大约每1.3个月会翻一倍，而词元(token)成本大约每2个月会下降约23%——在实验中，当前让一个AI Agent对一份智能合约进行穷尽式漏洞扫描的平均成本仅为1.22美元。

Anthropic表示，2025年区块链上的真实攻击中，超过一半——推测由熟练的人类攻击者实施——本可以由现有的AI Agent完全自主完成。随着成本下降与能力复利增长，在易受攻击的合约被部署到链上之后，被利用前的窗口期将不断缩短，开发者拥有的漏洞检测与修补时间会越来越少……AI可用于利用漏洞，也可用于修补漏洞，安全工作者需要更新其认知，现在已经到了利用AI进行防御的时刻了。