Vitalik Buterin Rejects AI Cyberattack Doomsday, Says AI Could Strengthen Security

Ethereum co-founder Vitalik Buterin has pushed back against growing concerns that artificial intelligence could give hackers an unbeatable advantage, arguing that the same technology could ultimately make software more secure.

Buterin made the argument in a September 17 post, rejecting the idea that AI-powered hacking means cybersecurity is doomed. He said AI could instead become a powerful defensive tool by making formal verification practical for increasingly complex software systems.

Buterin’s argument centres on formal verification, a process that uses mathematical proofs to establish whether a program satisfies specific security or functional requirements.

He suggested that if AI becomes capable of proving extremely difficult mathematical statements, it could potentially be used to prove that a complicated computer program meets a clearly defined security standard.

The idea would represent a significant shift from traditional cybersecurity, where developers search for vulnerabilities, patch them and repeatedly test systems for weaknesses. With sufficiently advanced AI, developers could instead use mathematical methods to provide stronger assurances about how software behaves.

Buterin acknowledged that the challenge is not simply getting AI to produce mathematical proofs. A crucial question is defining what “secure” actually means for a particular program. A proof can establish that software satisfies specified properties, but those properties must accurately capture the security requirements that matter in the real world.

The argument also does not mean cyberattacks will disappear. AI can assist attackers as well as defenders, potentially making vulnerability discovery and exploitation faster.

Research from the National Institute of Standards and Technology has similarly highlighted limits to creating completely secure AI systems, noting that fixed security safeguards cannot guarantee protection against every possible adversarial attack.

AI is already being used in cybersecurity on both sides of the conflict. Developers are deploying AI systems to analyse code, identify vulnerabilities and test software, while attackers can use increasingly capable tools to search for weaknesses and automate malicious activity.

Buterin’s argument is that this competition does not necessarily have to end with attackers gaining permanent control. If AI can eventually help developers mathematically verify large and complex software systems, defenders could gain a powerful advantage in protecting blockchain infrastructure, financial applications and other critical digital systems.

For the crypto industry, where software vulnerabilities can result in significant financial losses, the possibility of AI-assisted formal verification could become an increasingly important part of blockchain security.