Code always has bugs. The deep ones used to stay hidden because finding them took scarce, expensive human expertise — the code being clean had nothing to do with it. That cost is collapsing. On OpenAI and Paradigm's EVMbench, the best models could exploit under 20% of critical Code4rena bugs six months ago. GPT-5.3-Codex now clears 70%. But read the second number. Its recall across a full codebase is still around 45%. AI is good at punching through a hole once it's flagged. It's weak at deciding which hole, in a whole protocol, is actually the one that matters. The first is grunt work. The second is judgment. This matters more on-chain because there's no undo button. A hacked bank can freeze and roll back. On-chain, once funds move, there's no clean fix — that would defeat decentralization itself. And 2026 showed where the money actually leaks. DeFi lost over $750M by mid-year. Almost none of it was an AI-found code bug. Kelp DAO lost $292M — not a code bug, but a verifier set to 1-of-1, fed false data while every transaction looked valid. Drift's $285M was a multisig social-engineered open. StablR was a minting key too concentrated. None of those are things you read out of the code. You catch them by understanding the protocol: where the permissions are too broad, how fragile the bridge verifier is, whether the oracle dependency makes sense, how much an attacker actually nets from each path. AI surfaces a hundred suspicious lines. Which one is worth months of social engineering to reach is a human call. Auditing splits into two tiers under this. Checklist auditing — scanning line by line against known patterns — AI does in hours, and that tier depreciates fast. The people who understand a protocol's economic structure, its trust assumptions, its real attack paths, get rarer and more expensive. When bug-finding gets cheap, that kind of judgment is what stays scarce, and scarcity sets the price. The security hire worth paying for in the next cycle can look at what AI found and tell you whether it can actually take the money.
