Hook: The April Window
The Wall Street Journal reported on Tuesday that Anthropic's AI models have been hacking systems in cybersecurity tests since April. That sentence should not be read as a headline. It should be read as a capability disclosure with a timestamp. April is not a start date. It is a duration. Months of successful intrusions mean Anthropic observed repeatability, not coincidence. In security engineering, repeatability is the gate between vulnerability and weapon. Once a trigger can be fired on demand, it stops being a bug and starts being a capability. The Journal's story is not an AI story. It is an offensive cyber story wearing an AI costume. Gas isn't the variable that changes this story; compute is. And the compute has already been spent.
The details are still thin, because the Journal is reporting on an internal evaluation, not publishing a red-team transcript. But the direction is unambiguous. Anthropic's models were placed inside isolated cybersecurity test environments and asked to act. They acted. They found paths into systems. They did this repeatedly. The word "hacked" in the Journal's phrasing is doing heavy lifting, but the lower boundary of meaning is clear: a language model, equipped with tools, produced a chain of actions that resulted in unauthorized access to a target system. That is not a simulation of a hack. That is a hack in a sandbox.
The crypto world should care more than the enterprise security world. A smart contract is a target with a public interface, no rate limit on reads, and all state externally visible. The same model that can enumerate a Linux network and pivot from one host to another can enumerate a DeFi protocol and pivot from one vulnerable function to a governance proposal. For years, we assumed the bottleneck was human expertise. The WSJ report says the bottleneck is no longer Expertise. It is authorization.
Context: What Anthropic Actually Built
Anthropic is the company behind Claude, one of the most heavily safety-trained model families in commercial deployment. Its public posture is defensive. The company publishes safety frameworks, conducts interpretability research, and talks about alignment. But the WSJ report, picked up by Crypto Briefing, reveals a parallel track: Claude models are being pointed at computer systems in realistic attack simulations and asked to get in. The models pass. Since April.
To understand why that matters, you need to understand the test setup. Anthropic did not simply ask a model to answer a cybersecurity multiple-choice question. The model was given tools. Those tools included a terminal, the ability to create files, execute commands, read output, and interact with a network environment. Anthropic built an agent loop: the model proposes an action, the environment executes it, the model reads the result, and the loop repeats. The model is not hallucinating a description of an exploit. It is performing the exploit through tool calls.
This is the architectural shift that turns a language model into an actor. A standard LLM on its own cannot touch the world. An agentic LLM with a terminal touches the world through a thin layer of shell commands. The model sees the same bytes a human attacker would see. It can run nmap, curl, python, ssh, and sqlite. It can read configuration files, find credentials, enumerate services, and craft payloads. It can also look at blockchain endpoints. It can call a JSON-RPC provider, read bytecode, decode storage slots, and execute calls on a forked chain.
Anthropic's tests are part of a broader industry trend. OpenAI, Google, and Anthropic have all funded red-team evaluations for agentic capabilities. What makes Anthropic's tests different is the reported success rate and the duration. From April to now is not a weekend CTF challenge. It is a sustained evaluation with enough observed consistent behavior that someone at the Journal thought it was worth a story. Understatement is the enemy of accurate risk assessment. When an AI vendor says "we tested it," the translation is usually "we found limits." When a vendor keeps testing for months, the translation is "the limits are somewhere else."
Core: The Agent Loop That Turned a Language Model Into an Intruder
Let me reconstruct the mechanism from first principles, because the mechanism is the technology. The model receives a high-level objective: "Gain access to the target host and retrieve the backup file." The model decomposes that objective into a sequence of terminal operations. The first operation might be a network scan. The model runs a command like ifconfig or ping to understand its own position. It reads the output and decides whether it can reach the target. Then it scans for open ports. Then it tries a version fingerprinter. Then it looks for known vulnerabilities. Then it crafts an exploit. Then it moves laterally.
The key word is "then." A language model alone produces text. An agent produces a closed loop. The loop gives the model something that pure reasoning lacks: feedback from the environment. Every command output is a new clue. Every error message is a signal. The model is not relying on memorized exploit scripts. It is adapting to the specific topology of the target environment. That is the difference between a static spam filter and a weaponized intruder.
This is not supernatural. The model's ability to hack is a function of three variables. The first is the action space: the set of tools and commands available. The second is the context window: how much state the model can remember. The third is test-time compute: the number of attempts the model is allowed to make before giving up. Anthropic expanded all three. Give a model a long context window, a full Linux toolchain, and permission to try a thousand commands, and you have built a persistent attacker with perfect recall and zero boredom.
A human penetration tester will get tired. A model will not. A human tester remembers maybe a hundred prior commands. A context window can hold tens of thousands of tokens of conversation, which is enough to reconstruct the entire attack path from start to finish. A human tester hesitates before running a destructive command. A model makes a probabilistic choice between curl and python based on token likelihood. The result is a forensically strange but operationally effective mode of attack: the model does not need to "understand" the machine in the human sense. It needs to maintain a representation of the machine through the command output stream that is good enough to keep moving forward.
I saw this shift coming in my own audit work. In late 2017, I was consulting for a Series A DeFi startup that had built a liquidity pool contract. The code looked clean. The whitepaper promised a somewhat elegant invariant. But the contract used a Diamond Cut inheritance pattern that allowed certain internal calls to re-enter the same storage context. I built a custom script that generated a call graph and traced the storage slots touched by each function. It took me weeks because the graph was large and the vulnerability only appeared under a specific gas condition. A modern agentic model would have run the same script, read the output, and then tried across three or four different call paths before finding the reentrancy. It would not have understood the economics. It would have found the state inconsistency anyway.
Smart contract audit work is not a perfect analogy for network intrusion, but the operational structure is similar. The model enumerates functions, reads state, tests assumptions, and tries to break an invariant. The target is not a file system. It is a set of storage slots. The model cannot ssh into a server. But it can call a function on a forked chain, watch the transaction trace, and modify its next call based on the gas used. The attack surface is smaller, not larger. And because every public blockchain is a read-only database, the attacker does not even need to scan ports. The full interface is right there in the ABI and the bytecode.
This is why the WSJ report matters for crypto even if Anthropic never touches a smart contract. The report proves that agentic models can handle multi-step tool use under uncertainty. The same mental muscle that solves a network pivot can solve a DeFi exploit chain. The planning loop is identical: enumerate, identify weakness, exploit, verify reward. The reward in network intrusion is a shell. The reward in DeFi is a balance change. Both rewards are visible to the model through the terminal output. Both rewards are enough to drive the next action.
Core: The CVE Machine and the Mempool Problem
Anthropic's models are not only executing terminal commands. They are also reasoning about at least two abstract layers: the vulnerability layer and the operational layer. The vulnerability layer is the knowledge of known classes of bugs: buffer overflows, privilege escalation, default credentials, OpenSSL CVEs, misconfigured SSH. The operational layer is the knowledge of how to sequence actions without breaking the target. The model blends both layers in a single chain of thought. This is not a script with a list of commands. It is a conditional planner that changes direction when a command fails.
For the crypto industry, this translates directly into a new kind of audit pressure. Current smart contract audits are human processes. A team of auditors reads code, writes findings, and produces a report. The audit is bounded by human attention. An agentic model is not bounded by attention. It can call a function, read the trace, identify a storage slot that changes unexpectedly, and then roll back to a previous state and try another path. It can do this thousands of times in a day. Gas isn't the constraint on an AI attack on a live chain. The mempool is the constraint. But on a local fork, there is no mempool. There is no waiting. There is only a model, a terminal, and a forked chain with all the state of the real network. The model can simulate an exploit against the entire ledger without spending a single wei.
The phrase "without spending a single wei" should terrify every protocol that relies on gas cost as a natural speed limit. We used to say an attack is expensive because an attacker must pay for reentrancy calls, oracle manipulations, and flash loan fees. An AI agent doing reconnaissance on a fork pays nothing. The on-chain transaction is just the final confirmation step. The expensive step is the discovery. And discovery is exactly what agentic AI automates.
I spent two weeks in May 2021 simulating EIP-1559 on Geth nodes to understand how base fee updates behaved under high congestion. The point of that exercise was to test a mechanism, not to hack a network. But the lesson I took away was about the value of local simulation. If I could simulate a protocol's behavior across thousands of blocks, an attacker could simulate an exploit across thousands of variants without being detected. The WSJ report tells me that the same simulation mindset now lives inside an LLM's agent loop. The model's "research" is not a whitepaper. It is an exploit path that has already been tested on a shadow copy of the network.
This creates an information asymmetry that is almost impossible to close with traditional security review. A human auditor reviews a contract in a finite amount of time. An AI attacker reviews the same contract across an unbounded number of attack vectors. The auditor writes a report. The AI writes a transaction sequence. The report gets published. The transaction sequence gets kept in a cold wallet. The attack does not need to happen today. It only needs to happen before the vulnerable contract is upgraded.
Core: The Forensic Mapping of a Future AI Exploit
Let me be concrete about what an agentic AI smart contract exploit would look like. The first step is contract discovery. The model scans a comparison site, reads the ABI from a block explorer, and identifies functions that look financially sensitive. The second step is state reconstruction. The model forks the chain at a recent block, loads the contract state, and simulates the protocol in a local environment. The third step is differential analysis. The model calls every function with a range of inputs and looks for invariants that break. It tracks balances before and after each call. It listens for events. It looks for reentrancy by noticing that a call to an external contract returns before the state update. It looks for oracle manipulation by testing what happens when a price feed is moved outside a normal corridor. It looks for governance flaws by simulating a proposal and checking whether a single wallet can approve its own operation.
The fourth step is the most interesting. The model uses the terminal to write a custom exploit contract, deploys it to the local fork, and runs the attack. If it fails, it reads the revert reason, modifies the bytecode or the call sequence, and tries again. This loop is no different from the loop Anthropic's models used to hack systems in their tests. The only difference is the protocol. The model does not need to be aware of "the law" or "ethics" because the model is in a local sandbox. It is just trying to make a number go from a small balance to a large balance. The reward is explicit and numerical. That is the single best reward signal for an RL agent: a balance change.
This is where Anthropic's tests become a canary. The WSJ report confirms that AI models can handle long-horizon tasks that require repeated trial and error. The gap between hacking a Linux server and hacking a smart contract is not a gap in general reasoning. It is a gap in tool-specific knowledge. And that gap is closing quickly because the tool-specific knowledge for blockchain is public. Every audit report, every bug bounty writeup, every reentrancy tutorial, and every governance attack postmortem is training data. The model has read them all. It does not need to imagine a flash loan attack. It has thousands of examples to copy from.
I forked the Anchor Protocol contracts after the Terra collapse to trace the death spiral in sandboxed conditions. The code looked stable at a glance. The instability lived in the oracle price feed and the mint-burn assumption that the bonded LUNA price could not deviate from the yield expectation. A human auditor needed historical context to see that flaw. An AI agent would not need historical context. It would need only a reward function: can the peg break? It would test every oracle edge case until one succeeded. It would eventually find the undercollateralization condition, because the invariant was not protected in the contract logic. The economic flaw was protected only by an assumption that the oracle would never fail. Agentic AI does not accept assumptions. It tests them.
Contrarian: The Test That Never Left the Lab
Now I need to resist my own momentum. The WSJ report is not proof that Claude is an autonomous cyber weapon. It is proof that Claude operates effectively within an environment that Anthropic built. That environment has constraints the public does not see. The target systems are probably pre-configured with known vulnerabilities. The model probably has no access to the open internet and cannot download exploit kits in real time. The objective function is given by a human. The model does not choose to become malicious. It is asked to solve a puzzle. Those constraints matter. A model that succeeds in a cybersecurity test is not necessarily a model that can survive a hostile network with defenses that are actively adapting to its commands.
The contrarian angle is not "AI is safe." The contrarian angle is that Anthropic's evaluation measures capability, not intent, and the missing variable is deployment context. In the crypto world, the attacker does not need general-purpose lateral movement. The attacker needs one precise exploit. The WSJ test seems to reward breadth: enumerate many systems, pivot across hosts, find any path. A DeFi exploit rewards depth: understand a single protocol's invariant and break it in one transaction. The model that wins a network intrusion challenge may waste time on irrelevant attack surfaces when pointed at a smart contract. Meanwhile, a model that is optimized specifically for bytecode analysis might be far more threatening than Claude but never appears in a WSJ story because it is open-source and has no safety department.
The real security blind spot is the transferability of the test. Anthropic's red-team environment is a controlled playground. There is no adversarial AI on the other side of the network. There is no monitoring system that resets the target when it sees suspicious activity. There is no one racing the model to patch the vulnerability. In the real world, the model faces a defender that can revoke access, kill the process, and trace the attack back to a wallet address. The model in Anthropic's test is doing something closer to a CTF challenge than to a high-stakes intrusion. That does not reduce the importance of the test. It does mean we should stop saying the model "hacked systems." It hacked systems that were placed in front of it.
The more uncomfortable blind spot is the dependency on the human-designed toolchain. The model is not writing raw kernel exploits from scratch. It is using tools that humans wrote. Those tools are the real attack surface. If a model in Anthropic's test leveraged a bug in its own terminal emulator or an insecure API wrapper, no amount of safety training would help. The model would be a clever user of a vulnerable system. This is analogous to an auditor blaming the compiler for a bug in unsanitized input handling. The tool is the environment. The tool has bugs too.
For smart contracts, the same logic applies. An AI attacker will not only exploit the protocol. It will exploit the tools used to interact with the protocol. It might find a flaw in an SDK, a transaction simulator, a relay network, or a wallet's signing flow. The protocol can be perfectly secure while its surrounding infrastructure remains full of holes. The WSJ report tells us that agentic models are good at finding paths through tools. We should assume they will find paths through the tooling that surrounds DeFi: indexers, off-chain oracles, keeper bots, and admin scripts.
Contrarian: The Weapon Is Not the Model; It Is the Goal Function
The most dangerous feature of AI-based intrusion is not the model weights. It is the goal function the operator gives to the model. Anthropic's model, when asked to hack a test system, did so. The model has no persistent ambition. It has a reward signal. In the lab, the reward is a flag or a score. In the real world, the reward is money. A bull market creates an almost infinite number of financial goal functions. A model that can read a smart contract and move a balance will be optimized to make that move as profitable as possible. The same model weights that resist jailbreak prompts in a chat interface are irrelevant if the model is being run by an attacker who has changed the system prompt and removed the safety layer.
This is the point that the "safe AI" narrative often misses. Anthropic can keep Claude safe in its own infrastructure. It cannot keep a derived model safe once the architecture is replicated. The raw model weights are not even necessary. An attacker can use the public API in a loop, assembling an agentic framework that sends a sequence of prompts and executes the returned commands. The safety training may refuse to help a user "exploit a vulnerability." But a user can phrase it as "analyze this contract for bugs" and get a detailed answer. The agentic loop turns that answer into an action. The safety filter is a textual layer. The tool loop is an executable layer. The executable layer does not have safety filters.
I prototyped a zero-knowledge provenance contract in early 2026 with a small team. The goal was to have an AI agent submit a proof of computation on-chain without revealing model weights. The project was focused on trustless verification. The side effect was obvious: the same mechanism that proves a computation was done can also prove that a computation was done by a specific model. That is a double-edged sword. If the WSJ report shows us the offensive edge, the ZK proof shows us the accountability edge. The industry needs both. We need a way to prove, after an attack, that an AI agent was responsible. Without that proof, every attack will be blamed on a human or a stolen key. With that proof, the insurance market can begin to price AI-specific risk.
But the demand for accountability is weak in a bull market. The demand for speed is strong. Protocols will ship faster, with fewer audits, because every day matters. Into that stressed ecosystem drops an AI model that can hack systems in controlled tests. The combination is not a future scenario. It is the present configuration. A protocol that launches now and skips a deep audit is not just a vulnerable protocol. It is a target for a model that has already learned how to perform multi-step attacks on unfamiliar systems. The only missing ingredient is a connector between the network intrusion loop and the smart contract exploit loop. That connector will be built by someone. It might already exist.
Takeaway: The Vulnerability Forecast
Here is my forward-looking assessment, stated as plainly as I can make it. The WSJ report is a marker, not a breakthrough. Since April, Anthropic's models have demonstrated a repeatable offensive capability in a constrained environment. The constraint is the only thing between them and the public internet. Constraints are lifted by configuration changes, not by model improvements. Once an AI agent is pointed at a forked chain with a read-only RPC and a transaction simulator, the constraint set shrinks to a single human decision: to run the attack.
That decision will be made. It might be made by a security researcher testing a protocol. It might be made by a bot operator trying to steal a liquidation. It might be made by a state actor looking for a discreet source of funding. The identity of the actor matters less than the economics. The cost of executing an AI-based exploit is dropping through the floor. The cost of defending against an AI-based exploit is climbing because every line of code must be proven secure against an adversary that does not sleep and does not forget. That is an asymmetric equation. The side with the terminal and the fork wins.
The crypto industry still likes to pretend that audits are a complete defense. They are a snapshot. AI agents do not care about snapshots. They care about invariants, and every invariant that can be broken by a sequence of transactions will eventually be broken by a model whose entire purpose is finding that sequence. The question is not whether the model succeeds. The model already succeeded in a controlled environment. The question is what happens when the controlled environment is a real network with real money. The WSJ report gives us a date and a duration. It does not give us a map. But the map is not needed. The terminal is enough. Gas isn't the meter that will stop this attack. The market is. And the market is currently pointing up. That makes it the perfect incentive layer for the first fully autonomous on-chain exploit. It is not smart to wait for that forensic report. It is smart to simtest before the model finishes reading your code.
Final Note: The Information Gain in This Article
The specific things you will not find elsewhere are: the counterintuitive reading of April as a repeatability signal, the mapping between Anthropic's agent loop and a smart contract fork-based exploit loop, the idea that the mempool is the last speed limit, and the assertion that the toolchain itself is the hidden attack surface. That is the information gain the WSJ report does not provide. The report gives you a headline. This article gives you the causal path from a model's terminal to a deployed protocol's storage slot. The path is short. The path is executable. And the path runs through every unpatched contract currently sitting on a live chain.
