Vibe-Auditing: Why Your AI Security Review Isn't One

Duration: NaN:NaN:NaN

Speaker: Nicolas Garcia

Type: Lightning Talk

Expertise: Some familiarity with the topic

Event: Devcon

Date: Nov 2026

Producing security findings is now nearly free. Verifying them is not. In January curl shut down its bug bounty: fewer than one in twenty reports was real, the rest was AI slop. Months earlier, one researcher ran AI scanners over the same code, verified every result himself, and got about 50 real bugs fixed. Same tools. The difference was the human. I audit DeFi protocols for a living and I see the same split every week. Some auditors use the model to build real understanding of the code. Others forward its output and call it a review. That second one is vibe-auditing, and the false assurance it produces is what gets protocols drained. The Ethereum Foundation just ran AI agents against Ethereum's own code and titled the writeup "The triage is the product". In five minutes I will show where the human still does the work: verify every explanation, hunt where models are blind, triage everything they produce. No PoC, no finding. You leave with a cheat sheet you can use the next morning.