Topic starter
18/08/2026 2:23 pm
TL;DR: Crypto exploits cost an estimated $3.4B in 2025, and Quantstamp argues the response is not more manual review but security agents that can standardise checks, verify findings, and scale alongside automated attackers. The real governance question is whether teams can evaluate agent output like infrastructure, with repeatable workflows and human validation.
Editorial analysis by NHI Mgmt Group, based on content published by Quantstamp: “The Exploit Race”.
Key questions
Q: What is the main governance risk when security teams rely on AI agents for audits?
A: The main risk is treating agent output as if it were already validated.
Q: Why do security agents need verification loops instead of single prompts?
A: Single prompts are unstable because wording, context, and assumptions can change the result materially.
Q: What do AI security teams get wrong about benchmark-based red teaming?
A: They often assume the benchmark is objective when the prompt set and rubric may be doing most of the work.
Practitioner guidance
- Define agent evaluation criteria before deployment Set measurable standards for precision, recall, reproducibility, and evidence quality before any agent enters the review workflow.
- Separate discovery from verification Use one pass to surface hypotheses and a second pass to prove exploitability with traces, tests, or targeted simulation.
- Limit context to what the task requires Feed agents only the minimum code, state, and protocol context needed for the specific check to reduce noise and leakage risk.
Bottom line: Web3 security is moving toward agent-assisted review because attackers already exploit vulnerabilities at machine speed, and manual-only workflows are no longer enough.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:14 pm
Agent governance is now part of software assurance, not an AI side topic. The article shows that once security review becomes agent-assisted, teams are no longer only validating code, they are validating a decision workflow. That is a governance problem because repeatability, context control, and evidence standards now determine whether the output is operationally meaningful. Practitioners should treat agent pipelines as governed controls, not informal productivity aids.
A question worth separating out:
Q: Should security teams use one agent or several for code review?
A: Several agents are usually better than one, provided the team can handle the extra triage. Different tools catch different patterns, and comparing outputs helps surface blind spots and model-specific failure modes. The goal is not volume for its own sake, but a better noise-to-signal ratio and stronger coverage across protocol styles.
👉 Read our full editorial: The exploit race in web3 is turning security into automation