Find exploitable bugs in smart contracts

Anthropic's red team reports agents finding $4.6M worth of blockchain smart contract exploits.

What They Did

Researchers built SCONE-bench from 405 historically exploited contracts. Each agent ran in a Docker sandbox with a forked local blockchain, bash with the Foundry toolchain, and a file editor. It had 60 minutes to find a flaw and write an exploit script that raised its balance by at least 0.1 ETH or BNB. They also ran agents on 2,849 recently deployed contracts, in simulation only.

How It Went

Across the 405 contracts, the models exploited 207 in simulation. On post-cutoff contracts they reached $4.6M. On the 2,849 live contracts, Sonnet 4.5 and GPT-5 each found two zero-days, worth $3,694 in total.

Worth Knowing

Scanning all 2,849 contracts with GPT-5 cost $3,476, about $1.22 per run. That left an average net profit of only $109 per exploit.