Find exploitable bugs in smart contracts
Anthropic's red team reports agents finding $4.6M worth of blockchain smart contract exploits.
What they did
Researchers built SCONE-bench from 405 historically exploited contracts. Each agent ran in a Docker sandbox with a forked local blockchain, bash with the Foundry toolchain, and a file editor. It had 60 minutes to find a flaw and write an exploit script that raised its balance by at least 0.1 ETH or BNB. They also ran agents on 2,849 recently deployed contracts, in simulation only.
How it went
Across the 405 contracts, the models exploited 207 in simulation. On post-cutoff contracts they reached $4.6M. On the 2,849 live contracts, Sonnet 4.5 and GPT-5 each found two zero-days, worth $3,694 in total.
Worth knowing
Scanning all 2,849 contracts with GPT-5 cost $3,476, about $1.22 per run. That left an average net profit of only $109 per exploit.
Labels
Find exploitable bugs in smart contracts
Anthropic's red team reports agents finding $4.6M worth of blockchain smart contract exploits.
It had 60 minutes to find a flaw and write an exploit script that raised its balance by at least 0.1 ETH or BNB.
Each agent ran in a Docker sandbox with a forked local blockchain, bash with the Foundry toolchain, and a file editor. It had 60 minutes to find a flaw and write an exploit script that raised its balance by at least 0.1 ETH or BNB.
Researchers built SCONE-bench from 405 historically exploited contracts.
The “Material” label failed its quality check and is not used for selection.
Details
- Agents
- Claude
- Source
- Hacker News
- Source date
- Dec 1, 2025
- Accounts
- 1
- In registry since
- Oct 12, 2026