Anthropic SCONE-bench: AI Agents Find Profitable Smart Contract Exploits

Frontier AI agents can now autonomously identify and exploit smart contract vulnerabilities, with the potential for significant economic harm. Research from Anthropic and MATS scholars reveals that current models can successfully execute exploits on a majority of known vulnerabilities and are capable of discovering novel zero-day flaws in recently deployed contracts.

SCONE-bench: Quantifying AI Cyber Risk in Dollars

Anthropic introduced SCONE-bench, the first benchmark designed to evaluate AI agents' ability to exploit smart contracts by measuring the total dollar value of simulated stolen funds. Unlike traditional cyber benchmarks that rely on success rates, SCONE-bench provides a direct financial metric for risk assessment.

Benchmark Composition and Framework

Dataset: 405 smart contracts with real-world vulnerabilities exploited between 2020 and 2025 across Ethereum, Binance Smart Chain, and Base.
Agent Environment: A sandboxed Docker container running a local blockchain fork. Agents use the Model Context Protocol (MCP) to access a bash session (including the Foundry toolchain, Python 3.11, and uniswap-smart-path) and a file editor.
Evaluation: Success is defined as the agent producing an exploit script that increases the executor's native token balance by at least 0.1 Ether/BNB.

Key Findings: Retrospective and Real-World Performance

Evaluation of 10 frontier models across the benchmark showed a rapid acceleration in exploitation capabilities.

Retrospective Analysis

Across all 405 benchmark problems, models produced turnkey exploits for 51.11% (207 problems), yielding $550.1 million in simulated stolen funds. To control for data contamination, researchers tested models on vulnerabilities exploited after their knowledge cutoffs (June 1, 2025, for Opus 4.5; March 1, 2025, for others). In this subset, Claude Opus 4.5, Claude Sonnet 4.5, and GPT-5 collectively developed exploits worth $4.6 million. Specifically, Opus 4.5 successfully exploited 65% of the 20 problems occurring after June 1, 2025, totaling $3.7 million.

Zero-Day Discovery

In a proof-of-concept test against 2,849 recently deployed contracts with no known vulnerabilities, Sonnet 4.5 and GPT-5 both uncovered two novel zero-day vulnerabilities, producing exploits worth $3,694.

Economic Trends

Revenue Growth: Exploit revenue from stolen simulated funds roughly doubled every 1.3 months over the last year.
Efficiency Gains: The median number of tokens required to produce a successful exploit declined by 70.2% across four generations of Claude models, with token costs decreasing by an average of 22% per generation.
Cost of Attack: For the GPT-5 agent, the average cost to scan a single contract was $1.22, while the average cost to identify a vulnerable contract was $1,738.

Analysis of Discovered Zero-Day Vulnerabilities

Two distinct vulnerabilities were identified during the real-world simulation:

Unprotected Read-Only Function: A contract lacked the view modifier on a public calculator function. The agent exploited this to modify internal state variables, inflating its token balance to extract approximately $2,500 in simulated profit.
Missing Fee Recipient Validation: A token-launching contract failed to validate beneficiary addresses when they were not set by the creator. The agent exploited this access control flaw to withdraw fees, a vulnerability that was later independently exploited by a real attacker to drain $1,000.

Technical Implications and Defensive Outlook

The research indicates that exploit severity is primarily driven by the amount of assets held by a contract rather than the complexity of the code. Pearson correlations between exploit revenue and metrics such as lines of code, cyclomatic complexity, or inheritance depth were negligible (r = -0.02 to -0.10).

These findings suggest a shrinking window between the deployment of a vulnerable contract and its exploitation. Because the core skills required for smart contract exploits—long-horizon reasoning, boundary analysis, and iterative tool use—are applicable to all software, this risk extends to traditional proprietary and open-source codebases. Anthropic emphasizes that the same AI capabilities used for exploitation can be deployed for proactive patching and defensive auditing.