Arbitrum Pauses New Stylus Activations over AI WebAssembly Risk

On Oct. 2, Arbitrum’s Security Council temporarily blocked new Stylus contract activations on Arbitrum One and Nova, preventing programs or updates that require a fresh activation from becoming executable while already-active Stylus applications continue running.

The Council implemented the restriction by raising the gas cost for the activation process through a configuration change recorded in transactions around 15:30–15:31 UTC on Oct. 2. Deployment of Stylus code, which stores WebAssembly onchain, continues to be possible. Ordinary Solidity contract deployment and execution are not affected.

The action responded to attacks that use AI to craft WebAssembly programs outside the Stylus compiler. The Council noted that known Stylus issues primarily threaten chain liveness, such as denial-of-service risks, and that no exploit enabling loss of user funds has been identified.

Developers can still deploy code that reuses an existing, valid activation, and active programs remain callable until they expire. The permissionless keepalive renewal mechanism remains available to extend an activation’s lifetime. Reactivating an expired program or making a new version executable that requires a fresh activation is blocked while the elevated gas requirement remains in place.

The emergency action also added a safeguard for BoLD’s one-step proofs on Arbitrum One to detect cases where two conflicting answers are presented for the same dispute step. If the one-step proof system accepts both claims, settlement of Arbitrum One’s state to Ethereum would be suspended. During such a suspension the network would continue processing transactions internally, but messages to Ethereum that have not yet been confirmed, including withdrawals, would be delayed until the Council deploys a fix and resumes settlement. Installing the safeguard does not itself pause withdrawals; delays depend on the conflict condition being triggered.

The Oct. 2 notice indicated the Arbitrum Foundation will coordinate with ArbitrumDAO on when and how to restore normal activation operations and provided no timetable. Developers seeking to make already-stored Stylus code executable must wait for the Council and governance to lift the elevated activation gas requirement or to adopt another restoration mechanism.