Spy vs. Spy: Security in the Age of AI | Jen Luker - Consensys, MetaMask

Hello and welcome to Spy Versus Spy Security in the Age of AI. Um, we're going to take a look at how both uh security defenders and threat actors are both using AI in the evergoing arms race. And unfortunately, the threat actors are winning as usual, but we'll see how both sides can maybe get a leg up. Uh, first we're going to take a look back at 2025. AI scams drove crypto fraud up 17% last year, which rad in about uh at least 14 billion on chain, and that's up from 12 billion the year before.

Um, and of course, a lot of that is due to advances in AI automation, but we're also seeing advances in impersonation tactics. uh attackers are now using AI to analyze social media and corporate websites in order to craft uh contextually perfect lures for their victims. Um, of course, deep fakes are getting insanely good. And there was one company, Arab, who lost $25 million to one deep fake conference call last year. So, just make sure you're being extra careful with those.

Um you can see from this graph from chain analysis that AI enhanced attacks are both high in val value and high in volume. Uh when you compare them to other types of attacks uh very much so some good news is that AI agents can now be used to conduct smart contract audits. The bad news is that they can also be used by threat actors to exploit those vulnerabilities if they find them first. Anthropic ran a sandbox simulation last year on real blockchains using a repo containing known vulnerabilities and exploits and they found $4.6 million in proven exploits.

Um the agents were then turned on to a bunch of newer contracts and they found two previously unknown vulnerabilities, also known as zero days. Um and while this is a great proof of concept, it should be noted that the success rate for the known exploits was only 51%. So, as of right now, AI should be used as a tool to aid with contract audits, but not as a replacement for human auditors. And before I go any further, I want to highlight that while everyone is jumping on the AI bandwagon and companies are pushing employees to experiment with AI to boost productivity, um this zeal and pressure can sometimes lead people to act re recklessly if they're using tools that have not been reviewed or approved by their companies. This is called shadow AI and it can be very dangerous and cost a lot of money.

um AI code doesn't always follow the best uh the best security practices and just because a tool is widely widely used does not mean it is inherently secure. So um I would say that smaller companies particularly in web 3 also tend to be at heightened risk just because they have a less robust security system in place. Um, so we did talk about the smart contract auditing, but models can also learn normal behavior for protocols and wallets, flagging suspicious pre-attack activity like weird contract deployments or activity from known illicit sources. You know, they can monitor for cryptojacking, clipboard hijackers, and wallet steelers. They can also be used for post exploit fund tracking uh where an agent follows stolen fund funds through uh dexes and mixers looking for cash out points and then ultimately they can compile evidence to be used by law enforcement.

And for a long time we've had defensive bots that frontr run attackers during active exploits in order to save funds. But uh security groups are already starting to experiment with AI enhancements. One of those examples is using uh better bidding in gas auctions so they can increase the probability of a successful rescue at lower cost. Taking a step back from the blockchain space, the enterprise security operations center area uh can be helped out by better detection of social engineering, you know, blocking of fishing attempts, uh deep fake analysis and looking for fraudulent domains and impostor uh websites which aids in brand protection. AI uses adapted ri adaptive risk assessment to flag behavioral anomalies like accessing excuse me accessing files at odd hours or from unexpected locations.

Um it can also instantly isolate endpoints before they're able to cause networkwide damage. This is laptops, phones, uh servers, things like that. And of course, documentation automation is going to save people a lot of time by generating things like incident reports, uh, post-mortems, run books, etc. And it's also becoming, uh, crucial already for application security teams to combat the influx of AI powered attacks with AI defenses. They can predict which vulnerabilities are most likely to be exploited.

Simulate patch deployment and predict breaking changes. Uh discovery and risk assessment of exposed assets uh is used for attack surface mapping. And for malware analysis, we're getting automated sandboxing, faster disassembly and deopuscation. And uh it's grouping malware by families and behavioral patterns rather than signatures. And of course, most vulnerabilities are not in the code that you write, but in the libraries and packages that you import.

And these are what lead to supply chain attacks, which can be existential threats to your project. So, please note with all of these things, uh, the severity designation, prioritization, remediation, all the decision-m still needs to be done by human review. We're not quite to plugandplay yet. Um this bleeding edge tech is very exciting but we cannot take its findings for granted and there is now this trend of various hacker groups uh they're exp experimenting with AI tools and flooding bounty programs with lowquality and unverified reports depending on the tools they're using and how they're using them. The true positive rate is somewhere between 20 and 80% which is a pretty huge gap.

Um, and the consequence of this is that security teams are being bogged down and burnt out and some of them are actually sunsetting their bounty programs. So, at the end of the day, if you're a bounty hunter or bounty group, remember that if you're submitting something sloppy, your reputation is now sloppy. Um, so now some examples of how bad guys are using AI. We've seen a surge of infoscealer attacks since late 2025 powered by social engineering campaigns that trick people into downloading malicious files and they're capitalizing on the AI craze. So these are coming from fake Google ads u social media posts posts in messaging apps like Telegram and Discord and they redirect users to uh malicious sites using a lure called clickfix and I just saw a report last Friday that threat actors are now abusing clawed out artifacts for this attack vector.

So remember that Windows, Mac OS and Linux are all vulnerable. So, please only use tools from trusted sources and never run unknown commands in your terminal. Um, I would be remiss if I didn't mention prompt injection where malicious input overrides an AI's original instructions. This hijacks its session to execute unintended commands. And think of this as kind of like SQL injection, but for natural language.

Prompt injection turns your AI from an assistant to an attacker's puppet using its own tools and permissions against you. It's the number one LLM risk and it is not going away anytime soon especially according to uh OpenAI's opinion. Um and of course we have to talk about the hottest topic right now which is openclaw which allows anyone to run their own proactive agent. But um in many cases the agent needs access to you user data keys accounts things like that um which can be dangerous and as we all know it by now they use skills which are the primary markdown files containing instructions links and commands. Um so remember when you're using these that skills are third part third third party code and they can be malicious.

Um now we have these powerful autonomous tools and their skills files that come from usually claud sorry claw hub uh but also other registries and as far as we know uh claw hub does not have any automated security scanning we don't know how many people are maintaining and managing that registry so these tools again they have high privilege access and users are blindly trusting setup steps and prioritizing speed over security. This is one example of a malicious skill found on Claw Hub. Um, many of the payloads found in these malicious skills are visible in plain text in the first paragraph of the skill MD file, which is kind of funny. Um, this exchange uh to add a little drama involves the open claw creator Peter Steinberger and it kind of shows how quickly things can get out of hand when you release something into the wild that involves these a advanced agentic um agents uh with capabilities. And basically if you don't think about the implications and you are putting the responsibility on users, you're kind of setting them up for failure because we know uh as a collective group users do not always act security-minded.

Jason Miller from one password described open claw as a thousian bargain. It's revolutionizing what's popular with autonomous agency, but it has real access to your local machine and everything that comes with that. So this makes it especially dangerous when you are running it on a machine that holds corporate credentials or has access to production systems. Now I'm not saying don't use openclaw but the onus is on you to ensure that you have your own security on lockdown. Use sandbox executions and keep agents away from sensitive credentials and personal data as much as you can.

And you have to realize that sandboxing means more than just running something on a virtual machine. Use automated scanning and manual manual reviews and be extremely skeptical of any skill that requires pasting commands into a shell or running downloaded binaries. And if you operate a register registry or marketplace, add publish time scanning and flag skills that include remote execution, offuscated scripts, or instructions designed to bypass user oversight. Treat skills folders like uh trusted code boundaries and strictly control who can modify them. For personal AI agents, the supply chain is not a detail.

It is really your entire product. And I had to sneak this onto a slide last minute. It was published just yesterday that Infosstealer malware is now targeting OpenClaw agents themselves. So, kind of to wrap up, uh, security teams often get kind of a bad rap for being blockers and bogging down progress, but an ounce of prevention is worth a pound of cure. There's always a trade-off when you're pitting security against speed or prioritizing for convenience.

You have to be smart about it. Crypto and blockchain companies um, and builders are prime targets. individual developers and small startups are vulnerable because they have less robust protections and are less uh you usually have a smaller pool of seasoned security professionals. And then on the other hand, larger more established companies are vulnerable because they can provide bigger payouts to the threat actors and a complex or sprawling organization creates a larger attack surface. So, at the end of the day, AI tools can make your life easier.

They're going to be necessary in order to keep up in this changing environment, especially when it comes to thwarting attackers. But please don't use it as an excuse to let your guard down or be lazy. Um, thank you so much for coming. My name is Lucer. This is a QR that leads to a page of most of the sources I linked.

Um, and thank you so much for coming. Stay safe out there.

[applause]