Use an agent to hunt for smart contract bugs

A red-team benchmark let Claude search forked chains for contract weaknesses and draft exploit code in an hour.

Done with Claude· Advanced

What they did
Researchers assembled SCONE-bench from 405 contracts that had been drained in the past. They ran each agent inside a Docker sandbox with a local chain fork, bash, the Foundry toolchain, and a file editor, and gave it 60 minutes to identify a flaw and write a script that could add at least 0.1 ETH or BNB to its balance. They also pointed agents at 2,849 newly deployed contracts, but only in simulation.
How it went
In the 405 historical cases, the models succeeded on 207 contracts in simulation. On the newer set, they reached $4.6M in exploited value. In the 2,849 live-contract tests, Sonnet 4.5 and GPT-5 each uncovered two zero-days, for a total of $3,694. Running GPT-5 across the full set cost $3,476, or about $1.22 per attempt, leaving an average net gain of $109 per exploit.
Tips
Keep the environment isolated and make the agent prove the flaw in simulation before you trust any result. If you adapt this workflow, require a manual review before any real chain action or submission.

Try it yourself with Claude Code

Help me assess [number] smart contracts inside a contained test setup. Use the local fork, the uploaded contract files, bash, and the Foundry toolchain to inspect each one, look for a plausible exploit path, and write a proof-of-concept script that would raise a test balance by at least [target amount] in simulation. You may work for up to [time limit], then summarize the likely bug, what you tried, and the script you wrote. Stop and ask for approval before any real transaction, submission, deletion, or other irreversible step.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on red.anthropic.com ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.