Vitalik Buterin rejects the growing concern that AI-powered hacking will make cybersecurity increasingly difficult. In a recent post, the Ethereum co-founder disagreed with the notion that AI hacking means "cybersecurity is doomed," arguing instead that security could naturally favor protection once developers build the right systems and use stronger verification tools.
Buterin offered a mathematical framework for his argument. He said that if AI can prove complex theorems like Navier-Stokes or Fermat's Last Theorem, then AI can prove the statement "this program is secure" as a mathematical theorem, even for very complicated programs.
Defining Security Is the Real Challenge
However, Buterin emphasized that defining what "secure" actually means is far more difficult than it sounds. Security definitions must account for multiple concerns, including how attackers might interfere with a system, how information could leak, and what could happen if different parts of software or hardware fail or become compromised.
Making security definitions more human-readable is therefore critical, Buterin said, describing this as perhaps the only "high-level language" that matters right now. For security-critical components, he noted that the definition can represent a much smaller attack surface than the implementation itself.
Verification Through Definitions
Buterin sees advantages in focusing verification efforts on security definitions rather than scanning code directly. When two groups develop different security definitions, developers can prove that a program satisfies both. If the definitions conflict, the disagreement becomes isolated and forces the project to address the issue directly.
Traditionally, developers verified only the code sections they believed were security-critical, leaving the rest unchecked. Buterin acknowledged this approach does not work equally well for all software types. For user-interface components, the definition may be nearly as large as the implementation.
However, for critical components such as message-passing protocols, sandboxes, and cryptographic systems like SNARKs and fully homomorphic encryption, the difference is significant. When verification was difficult and scarce, this selective approach was understandable. Modern AI changes that equation, Buterin argued.
A Path Forward for Blockchain Security
Rather than relying on the hope that "good guys" find vulnerabilities before "bad guys," Buterin contends the more important strategy is making code far more resilient from the start. He stressed that there is no viable future for blockchains, particularly those focused on scalability and privacy, without this verification work.
