2026-05-08 –, Masaryk Stage
AI coding agents, MCP servers, and community skills are becoming standard tools for developers. But they introduce attack vectors that no smart contract audit will catch. A live real-world demo of private key exfiltration and a defense checklist builders can apply today.
Ethereum developers are adopting AI agents across their entire workflow: writing Solidity, reviewing contracts, deploying to testnets, browsing documentation. Tools like Claude Code, Cursor, and Codex have become part of the daily stack. At the same time, MCP servers and community skills are extending what these agents can do: From connecting them to APIs and databases to even blockchain tooling.
The new attack surface exists entirely outside the smart contract layer. It targets the developer, not the protocol. An AI coding agent that reads poisoned documentation can be tricked into exfiltrating private keys from your .env file. An MCP server with hidden instructions in its tool metadata can hijack your agent into leaking secrets while returning perfectly normal responses. A community skill that looks legit can silently send your wallet config to an attacker. None of these show up in a security scan or trigger a test failure.
The talk will contain a live demo and actionable takeaways to improve your security when building with AI agents.
Security Tooling Developer @ OpenZeppelin
Bridging the gap between Web2 Cybersecurity and Blockchain