Topic starter
18/08/2026 2:23 pm
TL;DR: Crypto exploit losses reached an estimated $3.4B in 2025, with Quantstamp arguing that web3 security needs security agents because attackers already systematize vulnerability search. Audit workflows now have to verify findings, compare runs, and prove results before teams trust them.
Editorial analysis by NHI Mgmt Group, based on content published by Quantstamp: “The Exploit Race”.
Key questions
Q: Why do security agents need verification loops instead of single prompts?
A: Single prompts are unstable because wording, context, and assumptions can change the result materially.
Q: What do AI security teams get wrong about benchmark-based red teaming?
A: They often assume the benchmark is objective when the prompt set and rubric may be doing most of the work.
Q: What is the main governance risk when security teams rely on AI agents for audits?
A: The main risk is treating agent output as if it were already validated.
Practitioner guidance
- Define agent evaluation criteria before deployment Set measurable standards for precision, recall, reproducibility, and evidence quality before any agent enters the review workflow.
- Separate discovery from verification Use one pass to surface hypotheses and a second pass to prove exploitability with traces, tests, or targeted simulation.
- Limit context to what the task requires Feed agents only the minimum code, state, and protocol context needed for the specific check to reduce noise and leakage risk.
Bottom line: Web3 security is moving toward agent-assisted review because attackers already exploit vulnerabilities at machine speed, and manual-only workflows are no longer enough.
Glossary terms: Security Agent, Verification loop, Benchmark Drift, Agentic workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:14 pm
Agent governance is now part of software assurance, not an AI side topic. The article shows that once security review becomes agent-assisted, teams are no longer only validating code, they are validating a decision workflow. That is a governance problem because repeatability, context control, and evidence standards now determine whether the output is operationally meaningful. Practitioners should treat agent pipelines as governed controls, not informal productivity aids.
A question worth separating out:
Q: Should security teams use one agent or several for code review?
A: Several agents are usually better than one, provided the team can handle the extra triage. Different tools catch different patterns, and comparing outputs helps surface blind spots and model-specific failure modes. The goal is not volume for its own sake, but a better noise-to-signal ratio and stronger coverage across protocol styles.
👉 Read our full editorial: The exploit race in web3 is turning security into automation