# Anthropic reports AI agents found profitable smart-contract exploits in simulation [Canonical reading](https://escapemeridian.com/readings/anthropic-reports-ai-agents-found-profitable-smart-contract-14c2d0b4) Anthropic published this research on December first, twenty twenty-five. Its authors introduce SCONE-bench, a benchmark of smart contracts, and measure agents’ exploits by simulated stolen funds. In tests of historical vulnerabilities, three models produced exploits worth a combined $4.6 million on contracts exploited after the models’ knowledge cutoffs. In a separate simulation of recently deployed contracts with no known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API costs were $3,476. Anthropic says the experiments show profitable autonomous exploitation is technically feasible, while stressing that it tested only in blockchain simulators and had no impact on real-world assets. The authors argue that the results matter beyond blockchain: they expect falling costs and improving capabilities to leave developers less time to find and patch flaws, while the same agents could also help defenders. The study does not establish how often agents would find exploitable flaws or make a profit on live systems. Anthropic says it cannot determine profit from its historical benchmark because it selected contracts already known to be vulnerable. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Anthropic · Article Original source date: Dec 1, 2025 (2025-12-01T00:00:00.000Z). Date basis: Date stated on the publisher’s page. Added to Escape Meridian: 2026-11-09T22:03:23.293Z. First observed: 2026-10-18T18:07:21.120Z. Retrieved: 2026-10-30T02:45:51.815Z. - [AI agents find smart contract exploits](https://www.anthropic.com/research/smart-contracts) ## Limits Text as retrieved on October 30, 2026; originally published December 1, 2025. The historical benchmark uses contracts already known to be vulnerable, and Anthropic says it cannot determine the profit of attacks represented by those results. The reported exploit values and vulnerability findings come from simulated environments; Anthropic says it did not test exploits on live blockchains. ## Open question How often would agents find profitable vulnerabilities in live systems, where contract selection and market conditions differ from these simulations? ## Source-stated Anthropic’s authors introduce SCONE-bench to measure AI agents’ ability to exploit smart contracts using simulated stolen funds. > We introduce SCONE-bench—the first benchmark that evaluates agents’ ability to exploit smart contracts, measured by the total dollar value2 of simulated stolen funds. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated For vulnerabilities exploited after the models’ knowledge cutoffs, three models produced exploits worth a maximum of $4.6 million in simulated stolen funds. > Collectively, Opus 4.5, Sonnet 4.5, and GPT-5 produced exploits for 19 of these problems (55.8%), yielding a maximum of $4.6 million in simulated stolen funds. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated In simulation against recently deployed contracts without known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API cost was $3,476. > The agents both uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694,7 with GPT-5 doing so at an API cost of $3,476 - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says its proof-of-concept demonstrates that profitable, real-world autonomous exploitation is technically feasible. > demonstrating as a proof-of-concept that profitable, real-world autonomous exploitation is technically feasible. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says the experiments used simulators only and had no impact on real-world assets. > We never tested exploits on live blockchains and our work had no impact on real-world assets. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated The authors expect the time developers have to detect and patch vulnerabilities to shrink as costs fall and capabilities compound. > As costs fall and capabilities compound, the window between vulnerable contract deployment and exploitation will continue to shrink, leaving developers less and less time to detect and patch vulnerabilities. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says it cannot determine the profit of attacks represented by its historical benchmark because the contracts were selected as known vulnerabilities. > Importantly, it is not possible for us to determine the profit of such an attack, as we have already down-selected those contracts that are known to be vulnerable. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source and contributor context Anthropic · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: 13e40374-949c-5793-837a-409ffbfe562e. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T21:58:42.428Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: 0515383f0316b09e6bb75d99f9b03980d6029450d872ab147805e69e013a1d5f. Source text hash: 8eeec8c3be6ac21af3b329117df28fcb9706941301b474c5b659096df213a2e1. ## Revision and source-check history ### Version 1 — 2026-11-09T22:03:23.293Z Anthropic published this research on December first, twenty twenty-five. Its authors introduce SCONE-bench, a benchmark of smart contracts, and measure agents’ exploits by simulated stolen funds. In tests of historical vulnerabilities, three models produced exploits worth a combined $4.6 million on contracts exploited after the models’ knowledge cutoffs. In a separate simulation of recently deployed contracts with no known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API costs were $3,476. Anthropic says the experiments show profitable autonomous exploitation is technically feasible, while stressing that it tested only in blockchain simulators and had no impact on real-world assets. The authors argue that the results matter beyond blockchain: they expect falling costs and improving capabilities to leave developers less time to find and patch flaws, while the same agents could also help defenders. The study does not establish how often agents would find exploitable flaws or make a profit on live systems. Anthropic says it cannot determine profit from its historical benchmark because it selected contracts already known to be vulnerable. ## Original source Anthropic · Article Original source date: Dec 1, 2025 (2025-12-01T00:00:00.000Z). Date basis: Date stated on the publisher’s page. Added to Escape Meridian: 2026-11-09T22:03:23.293Z. First observed: 2026-10-18T18:07:21.120Z. Retrieved: 2026-10-30T02:45:51.815Z. - [AI agents find smart contract exploits](https://www.anthropic.com/research/smart-contracts) ## Limits Text as retrieved on October 30, 2026; originally published December 1, 2025. The historical benchmark uses contracts already known to be vulnerable, and Anthropic says it cannot determine the profit of attacks represented by those results. The reported exploit values and vulnerability findings come from simulated environments; Anthropic says it did not test exploits on live blockchains. ## Open question How often would agents find profitable vulnerabilities in live systems, where contract selection and market conditions differ from these simulations? ## Source-stated Anthropic’s authors introduce SCONE-bench to measure AI agents’ ability to exploit smart contracts using simulated stolen funds. > We introduce SCONE-bench—the first benchmark that evaluates agents’ ability to exploit smart contracts, measured by the total dollar value2 of simulated stolen funds. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated For vulnerabilities exploited after the models’ knowledge cutoffs, three models produced exploits worth a maximum of $4.6 million in simulated stolen funds. > Collectively, Opus 4.5, Sonnet 4.5, and GPT-5 produced exploits for 19 of these problems (55.8%), yielding a maximum of $4.6 million in simulated stolen funds. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated In simulation against recently deployed contracts without known vulnerabilities, Sonnet 4.5 and GPT-5 each found two novel vulnerabilities and produced exploits worth $3,694; GPT-5’s API cost was $3,476. > The agents both uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694,7 with GPT-5 doing so at an API cost of $3,476 - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says its proof-of-concept demonstrates that profitable, real-world autonomous exploitation is technically feasible. > demonstrating as a proof-of-concept that profitable, real-world autonomous exploitation is technically feasible. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says the experiments used simulators only and had no impact on real-world assets. > We never tested exploits on live blockchains and our work had no impact on real-world assets. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated The authors expect the time developers have to detect and patch vulnerabilities to shrink as costs fall and capabilities compound. > As costs fall and capabilities compound, the window between vulnerable contract deployment and exploitation will continue to shrink, leaving developers less and less time to detect and patch vulnerabilities. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source-stated Anthropic says it cannot determine the profit of attacks represented by its historical benchmark because the contracts were selected as known vulnerabilities. > Importantly, it is not possible for us to determine the profit of such an attack, as we have already down-selected those contracts that are known to be vulnerable. - [Supporting source](https://www.anthropic.com/research/smart-contracts) ## Source and contributor context Anthropic · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: 13e40374-949c-5793-837a-409ffbfe562e. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T21:58:42.428Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: 0515383f0316b09e6bb75d99f9b03980d6029450d872ab147805e69e013a1d5f. Source text hash: 8eeec8c3be6ac21af3b329117df28fcb9706941301b474c5b659096df213a2e1. ### uncertain — 2026-11-09T21:58:42.428Z — anthropic/claude-opus-5.5 Publication: 13e40374-949c-5793-837a-409ffbfe562e attribution — pass: The reading attributes the research to Anthropic and its authors, which matches this Anthropic publisher page by MATS and Anthropic Fellows scholars. The feasibility and shrinking-window claims are presented as Anthropic's or the authors' assertions rather than established facts. > In a recent MATS and Anthropic Fellows project, our scholars investigated this question summary — uncertain: The summary is otherwise faithful and keeps key caveats. However, the central term "smart contracts" is never explained, and it is not in the definitions list. A non-specialist would not know these are public programs on blockchains that hold and move funds without human oversight. That is why exploits translate directly into stolen money. "Knowledge cutoffs" is also unexplained, though it is less central. Smallest repair: add one plain sentence defining smart contracts, or add tooltip entries for both terms. > Smart contracts are programs deployed on blockchains like Ethereum. date — pass: The stated date of December 1, 2025 matches the UTC day of originalPublished. The reading relies on no events after that date and uses no hindsight framing. The source's forecast of shrinking patch windows is reported as the authors' expectation. The page was edited after publication, but the cited passages are core findings plainly part of the original piece. This is a publisher page, so no archive disclosure is needed. support — pass: Each claim matches its verbatim excerpt. These include the SCONE-bench introduction, the $4.6 million maximum across three models, the two novel vulnerabilities worth $3,694 at a $3,476 GPT-5 API cost, the proof-of-concept framing, the simulator-only testing, and the inability to determine profit on the historical benchmark. The unknowns about live systems are framed as open gaps, not as source claims. No benefits or costs are invented. > Both agents uncovered two novel zero-day vulnerabilities and produced exploits worth $3,694, with GPT-5 doing so at an API cost of $3,476. media — pass: No media was selected, and no verified candidates were supplied, so there is no media identity or relevance issue. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/14c2d0b40569d761dcffb1cf056ae1d689d5cf6e8be2285d51d33756efe6cffd/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/anthropic-reports-ai-agents-found-profitable-smart-contract-14c2d0b4.json)