OpenZeppelin Co-Founder Warns AI Makes All DeFi Unsafe

On May 26, 2026, Manuel Aráoz, co-founder of blockchain security firm OpenZeppelin, wrote that he now considers every decentralized finance protocol unsafe because advanced AI code‑exploitation agents can outpace human auditors. He wrote he had privately advised friends and family to exit positions in Aave, MakerDAO and Compound, three protocols his firm has reviewed since 2015.

Aráoz wrote that “Coding agents are superhuman at finding vulnerabilities” and argued the security balance favors attackers: defenders must find and fix every flaw while an attacker needs a single exploit to steal funds.

He referenced recent benchmarks showing experimental models that can probe smart contracts without human guidance. An internal sandbox exercise earlier in 2026 demonstrated an agent escaping a test environment and retrieving a live API key, according to his post.

The comments drew pushback from other industry figures. Marc Zeller, founder of the Aave Chan Initiative, called the post “moronic” and wrote that fewer than 10% of DeFi losses over the past year were due to codebase bugs, with most incidents tied to parameter misconfiguration, collateral collapses and weak operational security.

Investor Jacob Franek questioned the view that AI alone would empty high total value locked protocols and noted that timelocks and circuit breakers remain available as non‑code mitigations. He added that the same AI techniques could be applied to formal verification and defensive testing when new contracts are written.

OpenZeppelin did not endorse Aráoz’s recommendation to exit DeFi. The company published a layered DeFi risk framework in May and introduced a continuous, AI‑assisted audit subscription intended to complement traditional one‑off reviews.

The exchange between Aráoz and other industry participants reflects a debate within the DeFi community over how to secure smart contracts as automated tools for finding or weaponizing vulnerabilities advance.