In response to recent events where AI agents escaped their sandboxes and attacked real-world targets, Kaijern Lau, Senior Director of Engineering at CertiK, believes the industry must prepare by increasing its investment in AI security as the blockchain industry becomes intertwined with AI.
Key Takeaways
An AI agent hacking Hugging Face proves autonomous cyber warfare is real, urging Web3 to adopt AI security.While AI speeds up finding vulnerabilities, human experts must still verify their actual impact.CertiK is developing defensive tools like AI Auditor to counter automated attacks and secure Web3 projects.The world of blockchain security and auditing is rapidly changing as exploits and vulnerabilities are now being harnessed and discovered much faster due to the involvement of artificial intelligence (AI) in vulnerability discovery processes.
In an exclusive interview with Bitcoin.com News, Kaijern Lau, Senior Director of Engineering at CertiK, examined the role of AI in both these attacks and the process of auditing code to prevent them.
Lau stresses that AI can be a useful tool for identifying a vulnerability and examining potential attack vectors on a platform. Nonetheless, the involvement of a human-in-the-middle is still necessary “to ensure that the AI has analyzed the code thoroughly and to verify that any reported vulnerabilities are genuine rather than false positives.”
Lau declared that recent research covering hardware-wallet attack surfaces illustrates the limitations of AI and the relevance of human involvement. “AI can help surface patterns and accelerate analysis, but experienced researchers are still needed to validate the findings and assess their actual impact,” he assessed.
Hugging Face Incident Isolated, Not Proof Of “Rogue Agents”Lau stressed that the Hugging Face incident arose during a specific evaluation setting and that an instance of such a contingency does not mean that AI models are uncontrollable.
Even so, he pointed out that the attack highlighted the current capabilities of AI agents, which are increasingly able to execute complex cybersecurity operations, including identifying and combining weaknesses that appear manageable in isolation, such as an exposed service, a misconfiguration, excessive permissions, or compromised credentials, and turning them into a coordinated attack path at machine speed.
Consequently, this also shows how investing in AI for security purposes is becoming the norm for companies with code-based products, such as the Web3 and blockchain industry.
“AI will make both attackers and defenders more capable. That is why blockchain companies should invest more in AI-driven security to protect their code and infrastructure. We are entering an era where the key question is no longer whether to use AI, but how many AI resources (or tokens) organizations invest in defending their systems compared with the resources attackers invest in launching increasingly sophisticated attacks,” the expert declared.
AI and Blockchain Security: Where We StandWhile Lau is sure that AI and blockchain security will inevitably become intertwined, he acknowledges that it is still too early for vulnerability discovery and secure software development tasks to be completed without human intervention.
CertiK even considers defensive agents and its tools as part of the surface attack, as they can be probed for prompt injection, malicious tool inputs, excessive permissions, data leakage, or unsafe automated remediation. In fact, the company has designed a tool, the AI Skill Scanner, to help identify risks in AI skills before deployment, increasing the controls exerted over AI agents.
Lau revealed that CertiK will continue to invest heavily to build advanced AI-powered security. “Our in-house developers and security researchers are working around the clock to advance AI-driven blockchain security,” he confirmed.
CertiK has also developed AI Auditor, a tool that conducts an automatic analysis of blockchain projects, identifying common security risks. “This multi-model, multi-agent approach improves both the accuracy and reliability of security assessments,” said Lau, describing how the company was developing its defensive capabilities against AI-assisted actors.
AI’s Balancing Act: Where We Go From Here“AI dramatically elevates our threat detection efficiency and scope. CertiK has improved the efficiency of formal verification by integrating AI into its proprietary CertiK Prover engine,” Lau specified.
CertiK’s contribution to the space, Lau said, goes beyond detecting vulnerabilities and aims to ensure that defensive security measures stay ahead of these emerging AI threats by also training and employing its AI models to secure its customers.
“Overall, AI will be a net positive force for Web3 security, but it is undeniably a double-edged sword that requires a continuous balancing act,” Lau concluded.
