Ethereum's 'Glamsterdam' hard fork test schedule was called off after a security vulnerability was found, and researchers are deploying artificial intelligence (AI) agents to check the impact on existing smart contracts.

Cointelegraph reported on Oct. 25 that blockchain security firm ChainSecurity found problems in Ethereum Improvement Proposals EIP-8037 and EIP-8038 included in Glamsterdam that could affect safeguards in at least 13 decentralised finance (DeFi) contracts.

The issue arises as rules change for handling gas, which is used to calculate computation costs. Existing contracts set safeguards based on how they behave when there is not enough gas allocated to a call, but after the upgrade the same code could work differently than expected. Attackers could also exploit this to disrupt normal contract processing.

As a result, the planned rollout of the upgrade on the Hoodi testnet was delayed. Developers plan to set a new schedule after reviewing even the indirect effects of the rule change on existing contracts, and they have not halted operation of the testnet itself.

The response process used a collaborative method among AI agents. Eth Labs researcher Derek Chiang (데릭 치앙) said that researchers at Eth Labs and the Ethereum Foundation each ran AI agents to check contract vulnerabilities and, after confirming they were using the same approach, created a message board in the form of a GitHub repository to coordinate the work.

The approach was also expanded to checks for follow-on upgrades. Researchers also set up a separate message board to examine the impact of EIP-8198, known as 'Quick Slots', proposed for the next hard fork, 'Hegota'.

Chiang pointed out that the response was carried out under urgency because the vulnerability was found late in development. He said that in future, teams need to more thoroughly analyse from the early stages of development what problems protocol changes could cause for existing contracts.

The spread of AI is also affecting vulnerability disclosure policies. Bitcoin Core is separately classifying vulnerabilities that can be found with only a simple large language model (LLM) prompt. For such issues, instead of applying a standard disclosure embargo period, it responds by distributing patches for major maintained versions as quickly as possible and issuing security advisories. The view is that as AI has made it easier to rediscover vulnerabilities, delaying patches could instead increase risk.

The case shows that AI agents have been deployed in real protocol reviews as tools for vulnerability detection and coordination. As hard fork preparations, security verification and reviews of follow-on proposals proceed at the same time, the operating model of the blockchain development process is also changing.