AI Agents Rescue Ethereum's Glamsterdam Testnet After Critical Gas Bug

Ethereum cancelled the second and final testnet for its Glamsterdam hard fork this week after ChainSecurity found vulnerabilities in two gas-scaling Ethereum Improvement Proposals that put at least 13 DeFi contracts at risk. The bugs trace back to EIP-8037 and EIP-8038, and they break contracts that depend on how gas currently behaves when a call runs out of it. The upshot: an attacker may have been able to exploit the resulting vulnerabilities.

The Hoodi testnet dress rehearsal won't be rescheduled until all second-order effects of the fork have been gamed out properly. Derek Chiang of Eth Labs wrote on X that the vulnerability surfaced at a few minutes to midnight, "causing everyone to scramble to deal with the fallout."

"In the future, protocol designers would do well to conduct much more thorough analysis of potential breakages that their update might introduce, and to do so much earlier in the process," Chiang said.

How did AI agents join the rescue?

Chiang said two researchers — one from Eth Labs, one from the Ethereum Foundation — had independently spun up AI agents to scan contracts for vulnerabilities. When they realized they were running the same strategy, they "set up a message board for their agents in the form of a github repo" to coordinate the work.

He drew a direct parallel to the OpenAI-Hugging Face incident, where rogue agents set up a message board to coordinate attacks. "Well, turns out the same pattern is useful for the good agents too," he said. The exercise worked well enough that a second board now examines the effects of EIP-8198, known as "Quick Slots," proposed for the subsequent Hegota hard fork.

Can you really 'Steal My Bitcoin'?

A new website left deliberately unpatched for the PHP2Shell vulnerabilities wants to prove a Bitcoin wallet isn't exposed to the biggest cybersecurity scare of the year. The 'Steal My Bitcoin' site hides the key to a wallet worth around $2,000, accessible to the PHP user account through a binary called print-flag.

At the time of writing, the site had been up 25 hours without a successful hack, though heavy traffic and probing attempts periodically knocked it offline. The stakes are real: government agencies in the Netherlands, Australia, Japan, Finland and elsewhere took critical websites offline Wednesday as emergency patches were developed for two related critical flaws allowing unauthenticated attackers to execute code on affected servers without logging in.

What else moved this week?

• Solana's Alpenglow went live on mainnet around 1:54 pm UTC Wednesday, per the Solana Foundation's dashboard. Agave developer Anza says transaction finality fell from about 12.8 seconds to roughly 150 milliseconds. The first phase, Votor, replaces voting and finalization with direct validator voting and a certificate-based system, and should cut headline transaction counts by around 60%. A later Rotor phase will replace Turbine as the block data-distribution protocol. Post-upgrade DeFi activity has been flat or slightly down.
• Starknet voted to explore becoming a post-quantum L1. A seven-day governance vote drew about 3,200 votes, with 93.52% of voting power in favor. A separate binding vote is required for the actual shift; for now Starknet remains an Ethereum layer-2. "We're beginning work on a whitepaper even before we start the weekend, and hope to release a draft for public scrutiny in November," StarkWare CEO Eli Ben-Sasson said.
• Senator Richard Blumenthal — the Connecticut Democrat who tops the Senate's investigations subcommittee — asked Tether CEO Paolo Ardoino for records after the Wall Street Journal reported a $6.3 million deal with a marketing company co-founded by former White House crypto adviser Bo Hines. The letter demands "records and information related to contracts, payments, communications, and lobbying." Tether says an external investigation "found no evidence of wrongdoing."
• New York AG Letitia James seeks $1.37 billion from NovaTech founders Cynthia and Eddy Petion — roughly $1.13 billion in investor funds plus $232.5 million in interest — over a Ponzi scheme that hit more than 11,000 New Yorkers and an earlier AWS Mining scheme that targeted Haitian and other immigrant communities through prayer groups, social media and WhatsApp.
• Bitcoin Core is changing its disclosure policy because LLMs make some flaws so easy to rediscover that embargoes help little. "The embargo period achieves little but it delays the availability of a fixed release," developer Antoine Poinsot said.
• Defense Secretary Pete Hegseth barred Pentagon staff from using nonpublic information — classified or not — to bet on military action via platforms like Kalshi and Polymarket.
• JPMorgan Asset Management projects 10% annualized Bitcoin returns over the next decade versus 7.5% for large-cap US stocks and 5.5% for gold, while calling Bitcoin "a speculative asset and a hedge against monetary easing."

Markets ended the week with Bitcoin down 1.2% at $80,549 and Ethereum down 1.9% at $2,343, per CoinMarketCap. The Glamsterdam testnet now has no fixed date, and Ethereum developers will need to clear the full second-order audit — increasingly with AI agents doing the scanning — before the fork can return to the schedule.