The Next Frontier: Using AI Agents to Build Custom Slither Detectors

How I'm combining smart contract security with LLM-powered tooling — and why the intersection of Web3 and AI safety is where the real vulnerabilities hide.

Introduction: Why AI + Web3 Security Is Inevitable

I'm a Web3 security researcher. Over the past few weeks, I've been building custom Slither detectors for CEX interface smart contracts — tools that automatically find hardcoded API keys, missing signature verification, and plaintext credentials on-chain.

It's rewarding work. But it's also slow.

Writing one production-ready detector takes 2–3 days of focused effort: studying the vulnerability pattern, implementing the logic, testing against known contracts, eliminating false positives, and wiring it into CI/CD. For every new threat vector — oracle manipulation, reentrancy in CEX wrappers, access control bypasses — you start from scratch.

Meanwhile, the attack surface is expanding in a direction most auditors aren't watching: AI agents are starting to interact with smart contracts. They read state, call functions, generate files, and execute tools. And every one of those interactions is a potential vulnerability.

The intersection of smart contract security and AI agent safety is where the real vulnerabilities hide. This article is about how I'm starting to use AI to accelerate my security workflow — and why I think every serious Web3 security engineer will need to do the same within the next two years.

The Problem: Manual Detector Development Is a Bottleneck

Let me show you what I mean with a concrete example.

Imagine you're writing a detector that looks for hardcoded API keys. It works. It's in production. It has zero false positives — because I spent hours tuning the logic to distinguish legitimate constant declarations from actual secrets.

Now multiply this by every vulnerability pattern you want to catch:

Missing signature verification on CEX calls

Plaintext credentials stored on-chain

Oracle price manipulation in withdrawal flows

Reentrancy in cross-chain bridge wrappers

Access control bypasses in admin functions

Each detector is a small engineering project. And the threat landscape evolves faster than any single researcher can keep up. We need a faster way to iterate on security hypotheses.

The Solution: How AI Can Accelerate Security Research

I see two concrete ways AI can help — and I've been experimenting with both.

1. Generating Detector Templates

Instead of starting from a blank file, I now use LLMs to generate a working scaffold. The result is typically 70% of a working detector. It gets the structure right — the class inheritance, the method signatures, the result generation calls.

But here's what it usually gets wrong:

False positive logic: The AI doesn't know which patterns are legitimate in real codebases.

Context awareness: It can't tell if a "suspicious" oracle call is actually behind a timelock or multisig.

Edge cases: Reentrancy guards, access control modifiers, upgradeable proxy patterns — these require human judgment.

But 70% is a massive head start. What used to take 2–3 days now takes 4–6 hours of refinement.

1. Filtering False Positives from Slither Output

This is where AI shines even more. Slither's JSON output is verbose and noisy. A typical run on a medium-sized contract might return 50+ findings, of which only 5–10 are real issues.

My workflow is: I run Slither, export the results to JSON, and feed the output to an LLM with a request to analyze the findings and identify which are likely false positives based on context.

In my experiments, this approach has reduced manual review time by 60–70%. The AI is surprisingly good at spotting patterns like "this check is flagged as missing validation, but it's actually enforced by a modifier on the parent contract."

The Catch: Why AI Won't Replace Security Engineers

Here's where I need to be honest. AI is a powerful accelerator, but it introduces its own class of risks — especially when AI agents start interacting with blockchain systems.

Risk 1: AI-Generated Detectors Can Have Subtle Bugs

I once asked an LLM to write a reentrancy detector. It produced code that looked correct at first glance — but it was checking for an old syntax that is no longer used in modern Solidity. The detector would have missed every real vulnerability in modern codebases.

Lesson: AI doesn't understand the evolution of the language. You still need to review every line.

Risk 2: Agent Tool Misuse — The Emerging Threat Vector

This is the one that keeps me up at night. As AI agents like NousResearch's Hermes Agent become more capable, they're being given access to tools: file systems, APIs, and eventually, smart contracts.

Here's the scenario I'm worried about: An AI agent analyzes a smart contract and generates a report. The report is saved as a specific file format. That file format contains an embedded malicious payload — a shader exploit, a path traversal, a script injection. The next tool in the pipeline opens that file and executes the payload.

I wrote about this explicitly in a recent discussion with Teknium, the lead engineer behind Hermes Agent: "Each file format has its own attack surface. Input validation at the plugin boundary will be crucial as Hermes handles more untrusted outputs."

This isn't theoretical. As AI agents become more autonomous, the security of their tool interactions becomes as important as the security of the smart contracts they audit.

Risk 3: AI Doesn't Understand Business Logic

A detector can flag "admin function without timelock" as a vulnerability. But what if the protocol intentionally uses a fast admin path for emergency pauses? What if the "missing" access control is actually enforced off-chain through a multisig? AI can't know this. Only a human auditor with context about the protocol's design decisions can make that call.

The Future: Where This Is Heading

Based on my conversations with builders in this space, here's where I think the industry is going.

1. Continuous AI Security Agents

Imagine an AI agent that runs alongside your CI/CD pipeline, not just checking for known patterns, but learning from every new exploit. When a new vulnerability is disclosed on Immunefi, the agent automatically analyzes the exploit report, generates a custom Slither detector, tests it against your codebase, and opens a PR with the fix.

This isn't science fiction. Hermes Agent already has persistent memory and tool-use capabilities. The missing piece is the security-specific training data — and that's where researchers like us come in.

1. Automated Detector Generation from CVEs

Within two years, I expect to see systems that take a CVE description or an exploit writeup and automatically produce a working Slither detector. The human role shifts from "writing detectors" to "curating and validating AI-generated detectors."

1. Formal Verification + AI Hybrid Approaches

Static analysis (Slither) catches known patterns. Formal verification (Certora, Halmos) proves mathematical properties. AI fills the gap: it can generate hypotheses about business logic vulnerabilities that neither tool catches alone.

My prediction: In 2 years, every serious protocol will have an AI security agent running alongside their CI/CD — not replacing human auditors, but amplifying them.

Practical Recommendations: How to Start Today

If you're a Web3 security engineer (or aspiring to be one), here's how to start integrating AI into your workflow without compromising on rigor.

For Beginners:

Start with Slither JSON analysis. Run Slither on a contract, export to JSON, and ask an LLM to help you triage the findings. You'll learn faster by seeing how AI interprets the same data you're looking at.

Use AI for detector scaffolding. Don't copy-paste blindly — but use the generated code as a starting point. You'll save hours on boilerplate.

Always test on known vulnerable contracts. If your AI-generated detector doesn't catch the vulnerability in a test contract, it's not ready for production.

For Advanced Practitioners:

Integrate LLM filtering into your CI/CD. After Slither runs, pipe the JSON through an AI filter that flags likely false positives. Review only the high-confidence findings.

Build a dataset of your findings. Every time you confirm or reject an AI suggestion, log it. Over time, you can fine-tune a model on your specific audit style.

Experiment with agentic workflows. Tools like Hermes Agent (open source, from NousResearch) let you build agents with persistent memory and tool access. Try building one that monitors a specific protocol for new vulnerabilities.

Conclusion: The Engineer Who Uses AI Will Replace the One Who Doesn't

AI won't replace smart contract auditors. The stakes are too high, the context too nuanced, the consequences of a missed vulnerability too severe.

But the engineer who uses AI to accelerate their workflow — who can iterate on detector hypotheses in hours instead of days, who can triage 50 Slither findings in minutes instead of hours — that engineer will outpace the one who doesn't.

The intersection of Web3 security and AI agent safety is still early. The builders who start experimenting now — carefully, critically, with a deep understanding of both domains — will define the standards for the next generation of secure protocols.

Start small. Build one AI-assisted detector today. Test it rigorously. Share your findings.

The future of Web3 security isn't human vs. machine. It's human with machine — and the time to start building that partnership is now.

Resources:

My custom Slither detector: https://github.com/rdin777/slither-cex-detector

Hermes Agent (open source): https://github.com/NousResearch/hermes-agent

CDSecurity (Web3 security audits): cdsecurity.io

If you're working on AI + security tooling, I'd love to connect. Find me on Twitter @DinRid56379.