The triage is the product: running AI agents against Ethereum's protocol code

The Ethereum Foundation's Protocol Security team argues that the main product of running coordinated AI agents against protocol code is the triage that separates real bugs from plausible-looking ones, not the candidate generation itself. The team reports that its agents found a remotely-triggerable panic in libp2p's gossipsub, fixed and disclosed as CVE-2026-34219. The article's central rule is that a candidate counts as a finding only when a self-contained reproducer runs against the real code for someone who did not write it. It also says the team will not publish its own acceptance numbers, since those would reflect the target more than the method.