Aidan Gomez — one of the eight authors of the 2017 "Attention Is All You Need" paper, and today CEO of the enterprise AI firm Cohere — said out loud what most security desks only model in private. He called AI models the most potent cyber weapon in existence, then immediately called for strong regulation, sovereign control, and transparent security guarantees.
The quote ran on Crypto Briefing. Not an AI trade journal. Not a security operations blog. That distribution choice is the first signal worth reading.
Gomez is not a hype merchant. He co-authored the architecture that GPT, Claude, Gemini, Llama, and his own Command models still run on. When someone with that specific lineage describes a capability class as a weapon rather than a product, risk models should shift. What he did not provide was a single benchmark, model name, parameter threshold, or attack case study. No technical evidence, no data — just a warning from the singular author of a widely-cited capability.
That gap is where the real analysis lives. Over the past 90 days, my own watchlist shows cross-chain bridge exploits and phishing campaigns executing faster, with tighter social engineering, at lower per-attempt cost. Whether AI is the cause or merely a multiplier is the question nobody has answered with numbers yet. This article tries.
Context: Who Is Talking, and Why It Landed in Crypto
Aidan Gomez co-authored the Transformer paper. Cohere, the company he runs, sells enterprise LLM APIs, private deployments, and retrieval-augmented generation to finance, healthcare, government, and energy clients. Its strategic investors include NVIDIA, Oracle, Salesforce Ventures, Cisco, and AMD. Oracle Cloud hosts its models. The pitch is "sovereign AI" — models that run inside a customer's own perimeter, with data residency and audit trails.
That positioning matters, because this regulatory call is not coming from a neutral observer. It is coming from a vendor whose competitive advantage sharpens when compliance costs rise. Hold that thought. It returns in the contrarian section.
Why did it surface in crypto media at all? Because the crypto audience is now the most attentive reader of AI security news outside the AI industry itself. AI agent tokens, decentralized compute networks, and inference marketplaces all sit at that intersection. But there is no crypto-specific technical content in the original piece — no mention of smart contracts, wallets, bridges, or MEV. The bridge between "AI is a cyber weapon" and "your on-chain assets are at risk" was left for the reader to build.
So let me build it, whether the original author intended it or not.
Core: Where AI Actually Changes the On-Chain Attack Surface
Start with the honest baseline. Smart contract exploitation does not require frontier AI. In 2022, the Ronin bridge lost roughly $624 million to a private key compromise. In 2023, Euler Finance shed about $197 million to a flash-loan logic error. Neither attack needed a large language model. Both needed a careful human who understood the code.
What AI changes is not the ceiling of attack capability. It is the floor. It compresses the skill required to reach the ceiling, and it compresses the time between reconnaissance and execution. That is the entire thesis, and it holds up under a forensic lens.
Four attack vectors matter specifically to on-chain infrastructure.
Vector 1: Vulnerability discovery in unverified or poorly documented contracts. LLMs are trained on Solidity, Rust, and Move. A capable model with a long context window can ingest a deployed contract, trace its state dependencies, and surface reentrancy or oracle-manipulation paths in minutes. Based on my own audit experience, AI-assisted tooling has cut the triage phase — not the verification phase — by roughly 60 percent. The bottleneck shifted from "find the bug" to "confirm the exploit is economically viable under live liquidity conditions." A human auditor still bills $30,000 to $150,000 for the same surface area. The economics of finding a bug just collapsed.
Vector 2: Phishing and social engineering at scale. The most common entry point for wallet drains is not a contract bug. It is a human. A model that writes fluent Indonesian, English, and Tagalog can localize a phishing lure for one specific retail community in an afternoon. The cost of a phishing attempt trends toward zero. The cost of defending against an infinite supply of hyper-localized attempts does not. For exchanges and custodians, that asymmetry is the real operational threat — not the Hollywood version of a rogue AI draining a vault.
Vector 3: Autonomous agent execution. This is the genuinely new frontier. A model given tool access — RPC endpoints, wallet signing, transaction simulation — can chain reconnaissance, capital sourcing, and execution without a human in the loop at each step. The maturity here is contested. Public research sits between proof-of-concept and partial production. Anyone claiming a fully autonomous, consistently profitable on-chain attacker today is selling a narrative, not a product. But the direction of travel is unambiguous, and the tooling is already in the open.
Vector 4: Post-exploitation laundering. AI-assisted mixing, timing-analysis avoidance, and cross-chain routing make attribution harder after the fact. This is the quiet one. It does not make headlines, but it degrades every forensic response playbook in the industry — including the ones I rely on when I map a breach block by block.
Now the counterweight, the part alarmist framing always omits.
Every one of these vectors has an economic constraint. A model that finds a vulnerability still has to fund the exploit transaction, compete for block space, and exit liquidity before defenders or MEV searchers front-run the maneuver. On a chain with a public mempool, an obvious exploit gets copied within a block or two. The attacker's edge decays in seconds. This is why the highest-value exploits still favor patient, well-capitalized human operators over automated bots — the bot wins small and often; the whale wins big and once.
RISK WARNING — Read before acting on any AI-security narrative: - No public evidence yet attributes a major on-chain exploit to fully autonomous AI execution. Treat such claims as unverified. - Vendor warnings about systemic risk often align with that vendor's commercial interest. Separate the threat from the sales pitch. - Regulatory timelines run 6–18 months. Attack-tooling iteration runs in days. Do not assume protection is coming soon. - Retail defense is still basic: hardware signing, transaction simulation, and skepticism of unsolicited links — regardless of what the threat model becomes.
Here is where the infrastructure cost story collides with the security story. I have written before that ZK rollup proving costs are unsustainable unless gas returns to bull-market levels. Operators are already bleeding on proving overhead alone. Now layer a mandatory AI security budget — red-teaming, anomaly-detection models, agent sandboxes — on top of that. The margin math gets ugly fast. A rollup barely covering sequencer costs cannot simultaneously fund continuous adversarial testing. The industry keeps asking who will pay for security. In a bear market, the honest answer is increasingly nobody, until an incident forces the question.
And that incident will arrive before the regulation designed to prevent it.
This is the part of the Cohere narrative that the compliance framing obscures. Regulation moves on legislative timelines — the EU AI Act, the US executive order on AI, China's generative AI filing regime, Canada's AIDA — measured in 6 to 18 months for concrete cybersecurity clauses. Attack tooling iterates in days. The gap is not a bug in the policy. It is the structural condition of lawmaking.
There is a governance dimension here that almost nobody is connecting. When a protocol needs to patch an AI-discovered vulnerability fast — before an exploit drains a bridge — who actually authorizes the upgrade? In most cases, token-holder votes. And on-chain governance turnout sits persistently below 5 percent. The "community" that decides how fast a protocol can defend itself is, in practice, a handful of whales and VCs pulling strings behind the curtain. An AI attacker operating on a seconds timescale is not waiting for your seven-day governance vote to conclude.
The industry's attention is also misallocated in ways that are almost comic. Right now, a meaningful share of Bitcoin's engineering oxygen goes into inscribed assets and Runes trading — using a Rolls-Royce to haul cargo, insulting the car and moving almost nothing of value. Meanwhile, the security budget for the infrastructure that actually holds user funds is flat or shrinking. We are optimizing the wrong layer of the stack while the threat model evolves underneath it.
Contrarian: The Compliance Moat Nobody Is Naming
Here is the unreported angle, and the one that should make you uneasy.
When the CEO of an enterprise AI vendor calls for stricter regulation of his own category, two things are true at once. The warning may be sincere. And it may also be a competitive instrument.
Crypto readers know this pattern intimately. When a large exchange advocates for tighter licensing and "consumer protection" standards, compliance cost is a fixed cost that scales down for incumbents and scales fatally for small players. An enterprise vendor with data isolation, audit logs, and sovereign deployment already built can absorb a new compliance regime as a feature. An open-source maintainer with three contributors cannot.
If AI cyber-weapon risk becomes a regulated category, the competitive axis shifts from "whose model is most capable" to "whose model is most auditable, attributable, and controllable." That is a deliberate relocation of the battlefield. Cohere competes on enterprise governance, not on the frontier-capability leaderboard where it trails GPT and Claude-tier models. Regulation that de-emphasizes raw capability and emphasizes compliance favors that positioning precisely.
None of which makes the warning false. It makes the warning interested. Both can hold.
The second blind spot is open source. A model weight file, once published, cannot be recalled. Regulation targeting model capabilities risks either being unenforceable against open weights, or being enforced in a way that consolidates power among a handful of closed API providers. Both a regulator and an enterprise vendor benefit from the second outcome. Open contributors do not. Any AI security framework without a sane open-weights carve-out is, functionally, a moat-construction project wearing a safety vest.
I don't expect any vendor white paper to name this tension. I do expect it to be obvious in market structure 18 to 36 months out.
Takeaway: What to Watch, Not What to Fear
Watch three signals, none of them headlines.
First: whether Cohere publishes an actual technical security report — model cards, red-team disclosures, incident counts — or stays at the level of CEO commentary. Talk is free. Disclosure is binding.
Second: the first credible, attributed case of an AI agent executing a profitable on-chain exploit without direct human involvement at the signing step. That event resets every security budget in the industry, bear market or not.
Third: the specific text of the EU AI Act's cybersecurity clauses, and whether open-weights models get a workable exemption. That single line decides whether AI security regulation hardens the ecosystem or fragments it.
The most potent cyber weapon may not be a model at all. It may be a regulatory framework written by the vendors it is meant to govern. Whose hand is on that pen — and whose assets it protects — is the only question worth tracking from here.
