An attacker exploited a crypto software flaw four days after AI agents discovered it in an Anthropic-linked study, taking approximately $1,000 (£746) in trading fees, according to the researchers.
The team described the attack as independent. Its account does not establish that the attacker used AI, accessed its findings or benefited from the discovery.
The findings concern research conducted in 2025. The project tested both Anthropic's Claude Sonnet 4.5 and OpenAI's GPT-5, using blockchain simulations rather than live attacks.
Two Flaws, Different Outcomes
One vulnerability affected a token-launching service. Missing validation of fee recipients permitted unauthorised withdrawals. Researchers said they found no way to contact its developer before the separate attack.
The other involved a calculation function that could inflate token balances. Researchers reported that an independent ethical hacker recovered the assets at risk and returned them to their owners.
Those contrasting outcomes distinguish finding vulnerable code from protecting the assets connected to it. The researchers said their own tests had no impact on real funds.
Newer Tests Measure Simulated Losses
In a report published on 22 May 2026, Anthropic described an updated SCONE-bench evaluation containing 12 exploits reported after 1 January 2026. The company identified that date as the latest knowledge cutoff across the evaluated models.
Anthropic said Mythos Preview successfully exploited every vulnerability in the set. It reported $35 million (£26.17 million) in simulated proceeds, exceeding the next-best tested model by $15 million (£11.22 million). These were laboratory results, rather than money taken from customers.
The evaluation used eight trials per problem. Its results therefore reflect repeated opportunities to succeed. They do not promise that an agent would achieve the same outcome on its first attempt against a live service.
Anthropic calculated dollar values using historical token prices from the dates of the corresponding real exploits. The total measures performance against selected vulnerable contracts. It does not estimate the exposure of every cryptocurrency holder or establish that any contract can be breached.
Exploiting Bugs Is Easier Than Fixing Them
Separate research from OpenAI and crypto investment firm Paradigm examines three tasks: detecting vulnerabilities, repairing them and exploiting them. Their EVMbench evaluation draws on 117 curated vulnerabilities from 40 audits.
OpenAI reported that GPT-5.3-Codex scored 71% in exploit mode, compared with GPT-5's 33.3%. Exploit tasks ran on an isolated local blockchain using historical, publicly documented vulnerabilities.
Agents performed best when the objective was to drain funds in the test environment. Detection and repair proved harder. Some agents stopped after identifying one issue, while repairs had to remove vulnerabilities without breaking intended functionality.
OpenAI also cautioned that EVMbench does not represent the full difficulty of securing real services. Widely used contracts may have undergone greater scrutiny. Its scores should not be treated as directly comparable with Anthropic's simulated dollar totals, which measure a different outcome.
What the Four-Day Gap Establishes
For readers, the essential distinction is between a demonstrated capability and a verified threat to a particular account. A benchmark can show that an agent exploited specified code under test conditions. Establishing personal exposure requires evidence about the actual service and its security.
The four-day sequence is compelling chronology. It is not evidence of a connection between the researchers and the attacker.
The unresolved question is how defensive discoveries become effective protection before somebody else finds the same weakness.
