Are AI-Generated Smart Contracts Safe? What Research Shows

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Only after the review you would give human code. In a February 2026 study, a static analyzer flagged issues in 47% to over 75% of Solidity contracts from three leading models. Test, fuzz, review and audit before deploying.

Watch: Are AI-Generated Smart Contracts Safe? What Research Shows 1:47

Video transcript

AI agents now write production Solidity. Is their code safe to deploy? Only after the review you would give human code.

In a February 2026 Deakin study, a static analyzer flagged 47 to over 75 percent of contracts from three leading models. Treat them as leads. The tool misses complex attacks like flash loans.

On SolEval's real repository tasks, the best of 16 models passed unit tests only 26.29 percent of the time.

Attackers can use AI too. In Anthropic's simulations, agents built working exploits for 207 of 405 previously exploited contracts. Bug hunting is already cheap.

In February 2026, a Moonwell proposal priced an asset worth roughly 2,200 dollars at about a dollar twelve. Liquidations left about 1.78 million dollars in bad debt.

Four commits in its pull request carried a Claude co-author trailer, though Moonwell has not attributed the incident to AI. Its tests only checked that prices stayed above zero. A new check fails any price move over 1 percent.

Treat AI output as a first draft. Specify behavior up front, own every line, review what tests assert, fork-test configuration, fuzz invariants and audit before mainnet.

Guardian audits in three passes: design review, an invariant fuzzing suite and manual audit, while competing manual and AI-driven teams test the same scope.

Read the full article for the studies and the checklist, or talk to Guardian at guardian.security.

AI coding agents now write production Solidity. In public repositories, commits carry trailers such as "Co-Authored-By: Claude Opus 4.6."

So the question for founders is no longer whether to use them. It is what must happen before their code holds funds.

This report covers three studies, one public incident and what they mean for review.

What the Research Found

LLM-generated contracts, February 2026

Researchers at Deakin University tested Solidity from GPT-4.1, Gemini 2.5 and Claude Sonnet 4.5. They used 34 prompts written in a junior developer's style, and ran each ten times per model.

They checked the 1,033 contracts the paper reports with Slither, a static analyzer. Any low, medium or high finding made a contract count as vulnerable.

Model	Contracts flagged	Total findings	High severity
GPT-4.1	47.4%	232	24
Gemini 2.5	53.2%	294	41
Claude Sonnet 4.5	Over 75%	564	16

Reentrancy was the most common named class for every model. Access control and logic errors were common in Sonnet's output, with 70 and 67 findings.

Size mattered. Each 100 lines of code raised the expected number of findings by about 15%. Sonnet's contracts averaged 222 lines, against 33 for GPT-4.1.

The authors conclude that LLM-generated contracts "frequently exhibit severe security flaws that could be exploited in real-world settings."

Read the numbers as leads, not confirmed exploits. The authors note that Slither is signature-based and cannot detect complex issues such as flash-loan attacks.

The test contracts were also one or two files each, not full multi-file projects.

Code inside real repositories, 2025

SolEval, a benchmark accepted at EMNLP 2025, asked 16 models to write functions inside 28 real Solidity repositories.

The best model, DeepSeek-V3, passed the benchmark's unit tests in only 26.29% of tasks, even with ten attempts.

Giving models repository context and retrieval improved correctness. The authors found those aids "do not necessarily influence efficiency or security."

AI agents can also exploit

In December 2025, Anthropic tested AI agents on 405 contracts exploited between 2020 and 2025. In simulation, they produced working exploits for 207 of them.

Scanning 2,849 recently deployed contracts, agents running Sonnet 4.5 and GPT-5 found two new vulnerabilities. A GPT-5 agent run cost $1.22 on average.

Searching for exploitable bugs with AI is already cheap.

A Public Case: Moonwell

On February 15, 2026, Moonwell executed governance proposal MIP-X43. It enabled Chainlink OEV wrapper contracts on Base and Optimism.

One configuration priced cbETH from the raw cbETH/ETH rate, without multiplying by ETH/USD. The oracle read about $1.12 for an asset worth roughly $2,200.

Liquidations took 1,096.317 cbETH. Moonwell was left with about $1.78 million in bad debt, The Block reported on February 18, 2026.

AI co-authored commits

Pull request 578 added MIP-X43 and was merged on February 10, 2026. Four of its 11 commits carry a "Co-Authored-By: Claude Opus 4.6" trailer.

One of them is the commit that switched on the cbETH configuration.

Moonwell has not attributed the incident to AI-generated code, The Block reported.

In the same report, Mikko Ohtamaa, co-founder of Trading Protocol, said a human developer could have made the same mistake.

Moonwell's follow-up

Moonwell's pull request 702, merged on October 21, 2026, explains how the change passed CI. CI "stayed green" because the proposal had no price assertion.

The only generic check was that each price was above zero.

The new check snapshots every market price before a proposal simulation, and fails if any moves more than 1%. Its description says it was generated with Claude Code.

The takeaway is not "never use AI." Any change that touches prices needs a test that checks them, whoever writes it.

Patterns to Check For

The studies point to the same weak spots:

Known classes return: reentrancy, access control, logic errors and missing input validation.
More code, more findings: longer outputs carried more issues in the Deakin study.
Plausible but wrong: the best model solved about a quarter of SolEval's tasks.
Blind spots in tools: signature-based static analysis misses complex issues such as flash-loan attacks.

The Moonwell case adds two checks for any change, whoever writes it:

Units and composition: a price feed used without the conversion it needed.
Tests that assert too little: a price above zero instead of a price in range.

What Teams Should Require

Treat AI output as a fast first draft. Then hold it to the same bar as any code that holds funds.

Specify first. Write the intended behavior and invariants before prompting.
Own every line. A named engineer reviews and answers for each merged diff.
Review the tests. Check what AI-written tests assert, not just that they pass.
Fork-test configuration. Assert that prices, caps and roles are sane after every change.
Fuzz invariants. Cover solvency, accounting and rounding.
Run static analysis in CI. Triage every finding by hand.
Measure the tests. Mutation testing shows which planted bugs your suite misses.
Audit before mainnet. Include upgrades and governance proposals that touch prices or funds.
Mark AI-assisted commits. Reviewers should know where to look harder.

AI tools can help with review too. See the best AI tools for smart contract auditing, and why an AI audit alone is not enough.

How Guardian Audits It

Guardian's smart contract audit runs in three passes:

Design review: roles, upgrade paths, threat model and economic assumptions, before implementation locks in.
Invariant suite: reusable fuzzing harnesses around solvency, accounting, rounding and edge states.
Manual audit: senior researchers attack logic, integrations, privileged flows and oracle risk.

Two competing teams test the same scope in parallel. One focuses on expert manual review, and the other drives billions of frontier AI tokens.

An invariant suite fuzzes underneath both. That model is explained in what a hybrid AI and human audit is.

Frequently Asked Questions

Is it safe to deploy smart contracts written by AI?

Only after the tests, review and audit you would require of human code. Studies in 2025 and 2026 found frequent flaws in LLM-written Solidity, and static analyzers that check it can miss complex attacks such as flash loans.

Which vulnerabilities appear most in AI-generated contracts?

In a February 2026 Deakin University study, reentrancy was the most common named class for GPT-4.1, Gemini 2.5 and Claude Sonnet 4.5. Other common classes varied by model, including access control, logic errors and missing input validation.

Did AI-written code cause the Moonwell cbETH incident?

Moonwell has not attributed it to AI, The Block reported in February 2026. Four commits in the MIP-X43 pull request carry a Claude Opus 4.6 co-author trailer. In October 2026, Moonwell added a price check to its proposal tests.

Can AI audit AI-generated smart contracts?

It can help find candidate bugs, but no AI tool has shown it catches everything. For code that holds funds, pair AI tools with a human-led audit and verify every finding.

Sources

Audit your AI-assisted contracts before mainnet

Guardian's audits pair expert manual review with frontier AI and an invariant suite, so code from any author gets the same scrutiny.

Get an audit quote Explore smart contract audits