Ethereum Foundation opens role for AI security researcher

Ethereum Foundation is recruiting a protocol security researcher to use artificial intelligence, fuzz testing, and manual audits to find vulnerabilities across Ethereum’s core infrastructure.

Ethereum security role covers the full protocol

According to the job posting, the researcher will join the Ethereum Foundation’s Protocol Security team and investigate weaknesses across several parts of the network.

The work covers the execution layer, which processes transactions and smart contracts, and the consensus layer, which coordinates validators. It also extends to Ethereum’s peer-to-peer network, technical specifications, and the client programs that implement protocol rules.

Key responsibilities include developing fuzzing tools, reviewing changes scheduled for hard forks, manually auditing protocol updates, and coordinating the responsible disclosure of confirmed vulnerabilities. The researcher will also use AI systems to support automated vulnerability discovery.

Ethereum Foundation outlines duties for its AI security researcher role | Source: Ethereum Foundation

Such a combination reflects the limits of fully automated security testing. AI tools can generate large numbers of possible findings, but researchers must reproduce each issue, assess its impact, and separate genuine vulnerabilities from false positives.

Candidates need extensive knowledge of the Ethereum protocol. The Foundation said it prefers engineers who have contributed directly to protocol development or understand execution-layer and consensus-layer specifications.

Relevant programming languages include Go, Rust, Java, C#, Nim, and Python. The remote position is open to candidates in Europe and other regions globally.

AI tools have already found Ethereum bugs

The hiring follows the Ethereum Foundation’s recent tests of coordinated AI agents against protocol code, cryptographic software, and other systems used by the network.

In a July 9 technical post, the Protocol Security team said the agents had uncovered genuine flaws.

“The agents found real bugs…Agents finding bugs wasn’t the surprise. The surprise was how little of the work went into finding them, and how much went into telling the real bugs from the ones that just looked real.”

One confirmed finding was a remotely triggered panic in libp2p’s gossipsub component, part of the peer-to-peer layer used by Ethereum consensus clients. Developers fixed the flaw before it was disclosed as CVE-2026-34219.

However, the team said most of the work involved determining which AI-generated findings were real. Researchers required reproducible evidence, proof-of-concept code, and human review before treating a report as a vulnerability.

The new role formalizes that workflow by combining automated discovery with manual verification and disclosure management.

Hiring follows Ethereum Foundation restructuring

The recruitment comes less than a month after the Foundation dissolved its Protocol Support team as part of a restructuring that eliminated 54 positions, or about 20% of its workforce.

Protocol Support previously coordinated core developer meetings, tracked network upgrades, helped contributors navigate Ethereum Improvement Proposals, and operated training programs for new protocol developers.

Several former Foundation researchers have since moved into independent organizations. Former employees Mo Jalil, Oskar Thorén, and Aaryamann Challani created EthSystems, a for-profit company developing confidential Ethereum infrastructure for regulated institutions. Bitmine, SharpLink, and Consensys CEO Joe Lubin backed the venture.

Former Foundation researcher Francesco D’Amato also joined independent protocol research group Ethlabs on July 16.

The latest opening suggests the organization is still adding specialized staff in areas it considers essential, even as some development and coordination work shifts outside the Foundation.

Security remains central to Ethereum governance

The Foundation also appointed security researcher Pascal Caversaccio to its board on July 29 for an initial one-year voluntary term. His appointment expanded the board to four members and reinforced its stated focus on security, privacy, and censorship resistance.

For U.S. investors, protocol security has direct relevance because Ethereum supports spot exchange-traded funds, stablecoins, tokenized assets, and financial applications used by American institutions. A flaw affecting consensus or client implementations could disrupt infrastructure far beyond the Foundation itself.

The hiring process does not indicate that a new vulnerability has been discovered. Instead, the role expands the team responsible for reviewing future hard forks and finding weaknesses before protocol changes reach the main network.