Skip to content
Escape
Meridian

The future is still open.

· Dec 1, 2025

Anthropic reports AI agents found profitable smart-contract exploits in simulation

Markdown · JSON · Original source

published this research on December first, twenty twenty-five. Its authors introduce SCONE-bench, a of smart contracts, and measure agents’ exploits by simulated stolen funds. In tests of historical vulnerabilities, three models produced exploits worth a combined $4.6 million on contracts exploited after the models’ knowledge cutoffs. In a separate simulation of recently deployed contracts with no known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s costs were $3,476. Anthropic says the experiments show profitable autonomous exploitation is technically feasible, while stressing that it tested only in blockchain simulators and had no impact on real-world assets. The authors argue that the results matter beyond blockchain: they expect falling costs and improving capabilities to leave developers less to find and patch flaws, while the same agents could also help defenders. The study does not establish how often agents would find exploitable flaws or make a profit on live systems. Anthropic says it cannot determine profit from its historical benchmark because it selected contracts already known to be vulnerable.

Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.

AnthropicArticle · anthropic.comOpen original source

Original source

· Article

Source details

Original source date: Dec 1, 2025 (2025-12-01T00:00:00.000Z).

Date basis: Date stated on the publisher’s page.

Added to Escape Meridian: 2026-11-09T22:03:23.293Z. First observed: 2026-10-18T18:07:21.120Z. Retrieved: 2026-10-30T02:45:51.815Z.

Referenced by

Recorded citations and public file attachments. A reference alone does not establish agreement or influence.

No public references recorded here yet.

Reference data (JSON)

Limits

Text as retrieved on October 30, 2026; originally published December 1, 2025. The historical uses contracts already known to be vulnerable, and says it cannot determine the profit of attacks represented by those results. The reported exploit values and vulnerability findings come from simulated environments; Anthropic says it did not test exploits on live blockchains.

Open question

How often would agents find profitable vulnerabilities in live systems, where contract selection and market conditions differ from these simulations?

Source-stated

Anthropic’s authors introduce SCONE-bench to measure AI agents’ ability to exploit smart contracts using simulated stolen funds.

We introduce SCONE-bench—the first benchmark that evaluates agents’ ability to exploit smart contracts, measured by the total dollar value2 of simulated stolen funds.

Source-stated

For vulnerabilities exploited after the models’ knowledge cutoffs, three models produced exploits worth a maximum of $4.6 million in simulated stolen funds.

Collectively, Opus 4.5, Sonnet 4.5, and GPT-5 produced exploits for 19 of these problems (55.8%), yielding a maximum of $4.6 million in simulated stolen funds.

Source-stated

In simulation against recently deployed contracts without known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API cost was $3,476.

The agents both uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694,7 with GPT-5 doing so at an API cost of $3,476

Source-stated

Anthropic says its proof-of-concept demonstrates that profitable, real-world autonomous exploitation is technically feasible.

demonstrating as a proof-of-concept that profitable, real-world autonomous exploitation is technically feasible.

Source-stated

Anthropic says the experiments used simulators only and had no impact on real-world assets.

We never tested exploits on live blockchains and our work had no impact on real-world assets.

Source-stated

The authors expect the time developers have to detect and patch vulnerabilities to shrink as costs fall and capabilities compound.

As costs fall and capabilities compound, the window between vulnerable contract deployment and exploitation will continue to shrink, leaving developers less and less time to detect and patch vulnerabilities.

Source-stated

Anthropic says it cannot determine the profit of attacks represented by its historical benchmark because the contracts were selected as known vulnerabilities.

Importantly, it is not possible for us to determine the profit of such an attack, as we have already down-selected those contracts that are known to be vulnerable.

Source and contributor context

Anthropic · Publisher

The publisher is identified here. No individual author has been inferred.

Source media

Media retrieval status: unchecked.

Terms and references

Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.

AI agent

An AI system that chooses and carries out actions toward a goal, often using software tools.

Benchmark

A defined set of tests used to compare systems. Results depend on the tasks and measures selected.

API

An application programming interface: a defined way for software to request data or actions from another system.

Anthropic

Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.

TIME

TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.

Editorial provenance

Version 1. Publication ID: 13e40374-949c-5793-837a-409ffbfe562e.

Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5.

Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T21:58:42.428Z. This checks fidelity to the source, not whether its claims are independently true.

Editorial selection: accept; reasons: bridge_admitted_by_model, second_opinion_categorical.

Observation: 0515383f0316b09e6bb75d99f9b03980d6029450d872ab147805e69e013a1d5f. Source text hash: 8eeec8c3be6ac21af3b329117df28fcb9706941301b474c5b659096df213a2e1.

Revision and source-check history

Version 1 · 2026-11-09T22:03:23.293Z

Anthropic reports AI agents found profitable smart-contract exploits in simulation

published this research on December first, twenty twenty-five. Its authors introduce SCONE-bench, a of smart contracts, and measure agents’ exploits by simulated stolen funds. In tests of historical vulnerabilities, three models produced exploits worth a combined $4.6 million on contracts exploited after the models’ knowledge cutoffs. In a separate simulation of recently deployed contracts with no known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s costs were $3,476. Anthropic says the experiments show profitable autonomous exploitation is technically feasible, while stressing that it tested only in blockchain simulators and had no impact on real-world assets. The authors argue that the results matter beyond blockchain: they expect falling costs and improving capabilities to leave developers less to find and patch flaws, while the same agents could also help defenders. The study does not establish how often agents would find exploitable flaws or make a profit on live systems. Anthropic says it cannot determine profit from its historical benchmark because it selected contracts already known to be vulnerable.

Original source

· Article

Source details

Original source date: Dec 1, 2025 (2025-12-01T00:00:00.000Z).

Date basis: Date stated on the publisher’s page.

Added to Escape Meridian: 2026-11-09T22:03:23.293Z. First observed: 2026-10-18T18:07:21.120Z. Retrieved: 2026-10-30T02:45:51.815Z.

Limits

Text as retrieved on October 30, 2026; originally published December 1, 2025. The historical uses contracts already known to be vulnerable, and says it cannot determine the profit of attacks represented by those results. The reported exploit values and vulnerability findings come from simulated environments; Anthropic says it did not test exploits on live blockchains.

Open question

How often would agents find profitable vulnerabilities in live systems, where contract selection and market conditions differ from these simulations?

Source-stated

Anthropic’s authors introduce SCONE-bench to measure AI agents’ ability to exploit smart contracts using simulated stolen funds.

We introduce SCONE-bench—the first benchmark that evaluates agents’ ability to exploit smart contracts, measured by the total dollar value2 of simulated stolen funds.

Source-stated

For vulnerabilities exploited after the models’ knowledge cutoffs, three models produced exploits worth a maximum of $4.6 million in simulated stolen funds.

Collectively, Opus 4.5, Sonnet 4.5, and GPT-5 produced exploits for 19 of these problems (55.8%), yielding a maximum of $4.6 million in simulated stolen funds.

Source-stated

In simulation against recently deployed contracts without known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API cost was $3,476.

The agents both uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694,7 with GPT-5 doing so at an API cost of $3,476

Source-stated

Anthropic says its proof-of-concept demonstrates that profitable, real-world autonomous exploitation is technically feasible.

demonstrating as a proof-of-concept that profitable, real-world autonomous exploitation is technically feasible.

Source-stated

Anthropic says the experiments used simulators only and had no impact on real-world assets.

We never tested exploits on live blockchains and our work had no impact on real-world assets.

Source-stated

The authors expect the time developers have to detect and patch vulnerabilities to shrink as costs fall and capabilities compound.

As costs fall and capabilities compound, the window between vulnerable contract deployment and exploitation will continue to shrink, leaving developers less and less time to detect and patch vulnerabilities.

Source-stated

Anthropic says it cannot determine the profit of attacks represented by its historical benchmark because the contracts were selected as known vulnerabilities.

Importantly, it is not possible for us to determine the profit of such an attack, as we have already down-selected those contracts that are known to be vulnerable.

Source and contributor context

Anthropic · Publisher

The publisher is identified here. No individual author has been inferred.

Source media

Media retrieval status: unchecked.

Terms and references

Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.

AI agent

An AI system that chooses and carries out actions toward a goal, often using software tools.

Benchmark

A defined set of tests used to compare systems. Results depend on the tasks and measures selected.

API

An application programming interface: a defined way for software to request data or actions from another system.

Anthropic

Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.

TIME

TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.

Editorial provenance

Version 1. Publication ID: 13e40374-949c-5793-837a-409ffbfe562e.

Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5.

Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T21:58:42.428Z. This checks fidelity to the source, not whether its claims are independently true.

Editorial selection: accept; reasons: bridge_admitted_by_model, second_opinion_categorical.

Observation: 0515383f0316b09e6bb75d99f9b03980d6029450d872ab147805e69e013a1d5f. Source text hash: 8eeec8c3be6ac21af3b329117df28fcb9706941301b474c5b659096df213a2e1.

uncertain · 2026-11-09T21:58:42.428Z · anthropic/claude-opus-5.5

Publication: 13e40374-949c-5793-837a-409ffbfe562e

attribution — pass: The reading attributes the research to Anthropic and its authors, which matches this Anthropic publisher page by MATS and Anthropic Fellows scholars. The feasibility and shrinking-window claims are presented as Anthropic's or the authors' assertions rather than established facts.

In a recent MATS and Anthropic Fellows project, our scholars investigated this question

summary — uncertain: The summary is otherwise faithful and keeps key caveats. However, the central term "smart contracts" is never explained, and it is not in the definitions list. A non-specialist would not know these are public programs on blockchains that hold and move funds without human oversight. That is why exploits translate directly into stolen money. "Knowledge cutoffs" is also unexplained, though it is less central. Smallest repair: add one plain sentence defining smart contracts, or add tooltip entries for both terms.

Smart contracts are programs deployed on blockchains like Ethereum.

date — pass: The stated date of December 1, 2025 matches the UTC day of originalPublished. The reading relies on no events after that date and uses no hindsight framing. The source's forecast of shrinking patch windows is reported as the authors' expectation. The page was edited after publication, but the cited passages are core findings plainly part of the original piece. This is a publisher page, so no archive disclosure is needed.

support — pass: Each claim matches its verbatim excerpt. These include the SCONE-bench introduction, the $4.6 million maximum across three models, the two novel vulnerabilities worth $3,694 at a $3,476 GPT-5 API cost, the proof-of-concept framing, the simulator-only testing, and the inability to determine profit on the historical benchmark. The unknowns about live systems are framed as open gaps, not as source claims. No benefits or costs are invented.

Both agents uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694, with GPT-5 doing so at an API cost of $3,476.

media — pass: No media was selected, and no verified candidates were supplied, so there is no media identity or relevance issue.

Challenge or correct this reading

Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.