Urbelis said he believes AI could ultimately reshape the standard of care around smart contract development. Historically, teams might point to the cost and complexity of audits as a reason why some reviews were not conducted. This argument becomes more difficult when sophisticated security analysis is available on demand.
“A clean AI report will not be considered a defense,” he said. “A plaintiff could also argue it the other way: The equipment existed, it was cheap, and you should have grabbed it.”
The prospect raises broader questions for the industry: If AI-powered security reviews become ubiquitous, will investors expect them before funding projects, and could failing to run an AI-assisted audit ultimately be viewed as negligence?
Despite the promise of the technology, no researchers have said they believe AI is ready to replace human auditors.
While the machines are excellent at identifying coding flaws, Urbelis said they are weak at spotting economic and incentive-based vulnerabilities, which have contributed to some of crypto’s biggest losses. “Treasury depleting bugs often have twisted intentions and perverse incentives,” he said. “They still need an experienced guy in the room.”
The Swede also gave a similar warning. “‘Cloud, audit my smart contracts, make no mistakes’ is not a security program,” he said. “If the person running the tool can’t evaluate what comes back, you haven’t bought security, you’ve bought a false understanding of it.”