AI Agents Just Exploited $550M in Smart Contracts — And It Only Cost $1.22 Per Attack
For $1.22 — less than the price of a cup of coffee — an AI agent can now scan a smart contract, identify its vulnerability, and generate a working exploit. That is not a theoretical scenario from a security whitepaper. It is the measured result of SCONE-bench, the first benchmark that evaluates AI agents' ability to exploit real smart contracts, released by Anthropic and MATS Fellows researchers in late 2025. Across 405 contracts that were actually exploited between 2020 and 2025, ten frontier AI models collectively produced turnkey exploits for 207 of them, yielding $550.1 million in simulated stolen funds.
The implications ripple far beyond a research lab. DeFi protocols collectively hold over $100 billion in total value locked. If exploit capability keeps doubling every 1.3 months — the trajectory Anthropic's data shows — the security assumptions underpinning on-chain finance are approaching an inflection point.