Vitalik Buterin: AI makes cybersecurity stronger, not weaker

Ethereum co-founder Vitalik Buterin has spoken out against the growing view that AI makes cybersecurity an unwinnable fight. According to Buterin, over time AI actually gives defenders an advantage. He adds a personal detail: roughly 90% of his wealth is in crypto, which he describes as a deliberate bet on that conviction.

Ethereum is available at OKX and Bybit.

In brief:

• Buterin argues that AI can formally prove that software is secure, just as it can prove mathematical theorems.
• Good definitions of security are crucial and form a smaller attack surface than the code itself.
• Buterin says Ethereum is heading in this direction in the coming years, with full verification of all software as the goal.

AI as a weapon for defenders

Buterin is responding to the view that AI makes attackers so strong that cybersecurity can no longer be won. He does not follow that reasoning. In his view, security is already inherently in the defender’s favour, once the sector has its affairs in order.

He draws a comparison with mathematical proofs: if AI can prove complex mathematical theorems, then it can also formally demonstrate that a program is secure. That applies even to highly complex software. So it is not about who finds vulnerabilities faster, but about building software that is much harder to crack from the outset.

The definition of security is the real problem

A large part of his argument concerns what the word “secure” actually means. Using the example of messaging app Signal, Buterin shows how many aspects are involved in a good security definition. Consider forged messages, vulnerabilities in operating systems, attacks via the server, or keys leaking through hardware signals.

These definitions can run to thousands of lines of code and require precise thinking. Yet they form a smaller attack surface than the implementation itself. An additional advantage is that definitions work cumulatively: if a program satisfies two separate security definitions, both apply at the same time. With code, this works differently, because one error in a component can bring the whole thing down.

Buterin argues that in the past things often went wrong because developers verified only a small part of their code and left the rest out of consideration. His conclusion is that full verification of all layers is necessary: databases, networks, caching layers and the entire supply chain. Modern AI makes this achievable, according to him.

Ethereum wants fully verifiable software

Buterin makes clear that this approach is directly relevant to Ethereum. Without serious steps towards demonstrably secure software, he sees no future for blockchains, certainly not for networks that focus on scalability and privacy. He states that considerable progress has already been made, but that the coming years will be decisive.

The Ethereum price stands at $2.440 at the time of writing, a rise of 1.4% in the past 24 hours.