AI Agents Aid Recovery of ETH Glamsterdam Fork After “Steal My Bitcoin” Site

Ethereum’s planned Glamsterdam hard fork is facing additional delays after a security review found problems in two gas-scaling proposals. ChainSecurity’s findings prompted the cancellation of the second and final testnet, pushing the next rehearsal further out while teams assess the “second order” effects of the upgrade.

The broader theme this week: automation is increasingly being used for both offense and defense. An account manager at Ethereum ecosystem group Eth Labs described using AI agents to scan for contract breakages, including coordinating their work through shared message boards—an approach inspired by past attacker behavior.

Key takeaways

• Glamsterdam’s second testnet was cancelled after ChainSecurity identified vulnerabilities tied to EIP-8037 and EIP-8038 that could break gas-dependent contracts.
• Developers say the next testnet on Hoodi is not expected until teams model the knock-on effects of the fork more thoroughly.
• AI agents used for contract security testing were coordinated via a GitHub-based message board after researchers independently converged on similar scanning strategies.
• A separate cybersecurity story is drawing attention to PHP2Shell-era risk themes, while major network upgrades across Solana and StarkNet moved in different directions.
• Bitcoin Core is updating its disclosure policy as large language models make it easier to rediscover vulnerabilities quickly.

Ethereum’s Glamsterdam delay after gas-scaling security findings

Ethereum’s second and final testnet for the Glamsterdam hard fork was cancelled this week following a vulnerability discovery by ChainSecurity. The issues were linked to two gas scaling proposals—EIP-8037 and EIP-8038—both of which relate to how gas behaves during transaction execution.

According to earlier coverage from Cointelegraph, the bugs were particularly dangerous for DeFi applications relying on current gas behavior. ChainSecurity’s research indicated that contracts built around the way gas currently works could fail in scenarios where execution hits gas limits, creating conditions an attacker might exploit.

The risk is technical but consequential: if a call runs out of gas under new assumptions, the resulting contract behavior can diverge from what developers expected. The end result can be anything from broken functionality to exploitable edge cases, depending on how the application handles failed executions.

Why “second order” effects matter more than the initial patch

With the testnet exercise on Hoodi postponed, Ethereum developers are effectively pausing their rehearsal until they can better understand downstream impacts of the change. The source indicates that rescheduling is not expected until teams have gamed out “second order effects,” meaning not just the immediate protocol logic, but also how surrounding tooling, integrations, and contract patterns might respond.

In an X post, Derek Chiang of Eth Labs said the vulnerability was discovered shortly before the deadline, describing the situation as being “a few minutes to midnight,” and adding that this forced teams to scramble to address the fallout. That timing underscores how brittle last-minute security reviews can be—and why teams are increasingly trying to move testing earlier in the process.

“In the future, protocol designers would do well to conduct much more thorough analysis of potential breakages that their update might introduce, and to do so much earlier in the process.”

AI agents, coordinated scanning, and a playbook borrowed from attackers

Chiang also described how AI agents were used to search for potential contract breakages. Two researchers—one from Eth Labs and one from the Ethereum Foundation—reportedly spun up separate AI agents to scan contracts for vulnerabilities. Once they realized they were using the same general strategy, they coordinated their work by setting up a shared message board in the form of a GitHub repository.

The description is notable because it mirrors how malicious actors have historically coordinated through shared channels. Chiang specifically compared the approach to the pattern seen in an “OpenAI <> Hugging Face hack” involving rogue agents that used message boards to synchronize their efforts. In this case, the same coordination mechanism was used to speed up defensive analysis.

Beyond Glamsterdam, the exercise appears to be influencing how teams plan next: a second message board has been created to examine EIP-8198—also known as “Quick Slots”—which has been proposed for the subsequent Hegota hard fork. While it’s too early to know how many problems will surface there, the workflow suggests teams want to catch gas- and execution-related issues well before a final testnet deadline.

Cybersecurity threads: PHP2Shell proof attempt and policy shifts

Separately, the “Steal My Bitcoin” site continues to be used as a stress test in the wake of PHP2Shell vulnerabilities. The site is presented as an experiment intended to demonstrate that a Bitcoin wallet—estimated to be worth around $2,000—was not actually at risk from the “print-flag” behavior accessible via a PHP user account.

At the time of writing, the site had reportedly been online for about 25 hours without a successful hack, though it had gone offline at intervals due to heavy traffic and probing. The story sits in the broader context of PHP-related security incidents: the Cointelegraph-linked report referenced emergency patches and precautionary downtime taken by government and other organizations in multiple countries.

On the infrastructure side, Bitcoin Core is also adapting its security approach. In a post to the bitcoindev mailing list, developer Antoine Poinsot said that the classic approach—keeping vulnerability details under lengthy disclosure embargoes—has become less effective. The reason: large language models make it easier to rediscover flaws quickly, reducing the benefit of delaying public information and fixed releases. Poinsot said Bitcoin Core is therefore updating how it manages disclosure timing to “accommodate those.”

For users, traders, and builders, these policy shifts matter because they affect how quickly fixes reach the ecosystem—and how quickly attackers might learn what to target.

Network upgrades and governance: Solana’s Alpenglow and StarkNet’s post-quantum direction

Solana’s first major consensus upgrade, Alpenglow, went live on mainnet around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard. Agave developer Anza said the time for a transaction to become final decreased dramatically—from roughly 12.8 seconds to about 150 milliseconds.

The upgrade is being rolled out in phases. The first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system, with an expectation that the headline transaction count will fall by about 60%. A later phase will introduce Rotor, aimed at replacing Turbine’s block data distribution.

StarkNet, meanwhile, is taking a different path—at least at the research-and-planning level. The community voted to support research into becoming an independent, post-quantum layer-1 blockchain. The vote lasted seven days and reportedly attracted about 3,200 votes, with 93.52% of voting power in favor. StarkWare CEO Eli Ben-Sasson told Cointelegraph that StarkNet would begin work on a whitepaper and hopes to release a draft for public scrutiny in November. The source also states that any actual transition would require a separate binding governance vote, and StarkNet will continue operating as an Ethereum layer-2 for now.

Regulation and markets: scrutiny around stablecoins and shifting disclosure rules

On the regulatory front, Senator Richard Blumenthal has requested information from Tether CEO Paolo Ardoino after a Wall Street Journal report said the stablecoin firm inked a $6.3 million deal with a marketing company co-founded by former White House crypto adviser Bo Hines. In a Thursday letter, Blumenthal reportedly said the Senate Permanent Subcommittee on Investigations demanded records and information about contracts, payments, communications, and lobbying related to the agreement, raising questions about potential ethics, corruption, and lobbying rules. Tether said an external investigation found no evidence of wrongdoing.

Finally, in traditional market commentary, JPMorgan Asset Management projected that Bitcoin could outperform U.S. stocks and gold over the next decade in its 2027 Long-Term Capital Market Assumptions report. The report also cautioned that Bitcoin’s volatility means it does not currently make sense as a diversifier due to unstable market correlations, describing Bitcoin as a speculative asset and a hedge against monetary easing.

Looking ahead, the key watch items are whether Ethereum’s next Glamsterdam rehearsal on Hoodi reveals additional gas-related integration failures, how quickly teams can coordinate security testing for upcoming proposals like Quick Slots, and whether disclosure-policy changes in major ecosystems keep vulnerability management ahead of the pace set by AI-assisted discovery.