
Founding Security Researcher @blackthornxyz | Lead Senior Watson @sherlockdefi | Ai alt: @pkqs91
Joined January 2021
- Tweets477
- Following462
- Followers2.1K
- Likes3.1K
Built @sunyuchentron 's story into an AI galgame lmao. tldr, just trust claude for financial advice.
赚不到孙哥的钱,但可以过一遍孙哥的人生。
如果你是孙哥,会为了景甜去北京吗?
《我的女友景甜》游戏版,免费玩:dramori.ai/stories/my-girlfr…
vibe coded a LOT the past few weeks and here is a trick I want to share
I've been using @mattpocockuk skills for the past couple of weeks, and my productivity has probably 3x'd.
My usual work session starts with the /grill-me skill. Begin with a broad, messy task, and the agent keeps asking questions until the gaps are clear. The useful part is that while you're answering, you're also forced to understand the task better and dig into the details you skipped. One time it grilled me for 80+ questions and halfway through I was basically asking are we there yet every few minutes.
Then I run /to-issues skill and kick the issues off in goal mode. One detail I think is very important is to explicitly ask it to spawn subagents for each task, test the work when it's finished, and redo it if it's not actually done. Runs usually go for multiple hours, so once one is kicked off, I can start working on another session, or just go back to doomscrolling.
pkqs90 retweeted
$32,000 paid out. Two high-severity bugs. One Warden.
Huge shoutout to @pkqs90 for back-to-back high-severity findings in the @succinctlabs and @gmtrade_xyz bug bounties on Code4rena!
Here's a look at those payouts!🧵👇
Very solid codebase for @flyingtulip_ 🫡
Here are the results of the @flyingtulip_ Audit Contest!
1. @pkqs90 - $23,518 🥇
2. @taridoku - $4,478 🥈
3. @demorextess - $4,363 🥉
$100,000 in rewards, bringing Sherlock's total researcher payouts to $20.1M+.
Link below for the full results 👇
Prediction: By the end of 2026, the leading individuals in Web3 security won't be differentiated by critical thinking and hard work alone. It'll also come down to an AI-native auditing workflow.
If you're not running AI intensively in your regular audit process, you'll fall behind, fast.
pkqs90 retweeted
💡AI's Transformative Impact on Web3 Security: Predictions from Late 2026 Onwards💡
From late 2026 onwards what was once a domain dominated by human auditors poring over code will evolve into a hybrid ecosystem where AI amplifies human expertise, reduces costs, and reshapes incentives.
1⃣ Lowering Total Cost of Securing a Protocol
One of the most tangible impacts of AI will be a reduction in the overall cost of securing web3 protocols. Today in early 2026 we're already seeing specialist AI agents detecting a broad spectrum of vulnerabilities. Foundational models continue to improve in reasoning and skilled researchers are layering on custom heuristics, creating specialist AIs that can find valuable bugs "at scale".
External audits which can easily run into six figures for a comprehensive review have long been a pain point for protocols. If an initial audit uncovers too many findings protocols often face costly re-audits, delaying launches and inflating budgets. By late 2026 specialist "PR Review" agents will be commonly used during development to catch bugs early - and some specialist AI products can catch an impressive range of bugs today; this will only improve by late 2026 & onwards.
AI will also supercharge testing methodologies, making it much easier and cost-effective for developers to commonly deliver hardened codebases featuring invariant testing and formal verification.
The net effect? Protocols will require fewer external audits, lowering the total cost of securing a protocol.
2⃣ The Evolving Role of Human Auditors
Human auditors won't disappear; instead, their work will pivot toward higher-value activities. By late 2026, a growing number of auditors will shift from manual code reviews to developing and refining heuristics for specialist AIs.
The trend of auditors consolidating into larger firms will continue; expectations for efficiency will increase across the board. The best auditors will leverage AI to become super-human, highly-efficient bug-finding machines.
3⃣ Capped Auditor Remuneration in Maturing Market
The web3 security space is maturing rapidly. In the Wild West days of 2021-2024, sky-high fees and long waiting times were justified by rampant hacks and scarce expertise. But as many skilled auditors transition into creating heuristics for Specialist AI auditors vastly improving their vulnerability detection, clients will increasingly prioritize speed & value.
Market share will gravitate toward quality brands that consistently deliver great security output at an efficient price point, who provide great value for money. Intermediate-Senior human auditors will still be able to make a good living but the extremely expensive ones may struggle to remain consistently booked, a trend which played out especially through the first half of 2025 and will accelerate in the future.
New & Junior auditors will struggle as the bar to achieving professional success will be raised higher & there will be more competition than ever; they will be completely replaced by Specialist AIs who will consistently perform better providing more value than them.
4⃣ Shorter Exploit Windows and the Elimination of Common Bugs
AI's double-edged sword will manifest in exploit dynamics. On the dark side, blackhat AIs will exploit vulnerabilities faster than ever. A protocol launching with bugs in late 2026 could be drained in hours, not days, as blackhat AIs trawl the blockchain in real-time.
Conversely, mass adoption of specialist AIs by developers will nearly eliminate certain bug classes. Reentrancy, integer overflows, incorrect rounding direction and access control flaws could become relics, caught routinely during the development process and not even making it to external audits let alone to live deployment.
5⃣ Human-AI Symbiosis
Here's the key: Specialist AIs won't stay effective without human input. Auditors and researchers must continually update them with the latest heuristics, drawing from private/competitive audits, post-mortems of hacks and other threat data. This creates a virtuous cycle—humans teach AIs, AIs protect protocols, and the ecosystem grows more resilient providing increasingly efficient security "at scale".
In summary, from late 2026 onwards, AI won't replace web3 security professionals but will redefine the field as a collaborative powerhouse. Roles will evolve & markets will mature - for devs, auditors, and protocols: Embrace AI now, or risk being left behind.
Stats for 2025:
- Completed 20+ audits with @sherlockdefi / @blackthornxyz
- Won 2/4 contests I competed in
- Grabbed 3 H/M bounties
Fun facts:
- Teamed up with @thekmj_ earlier this year and together we achieved our worst contest result ever: last place with a solid 0 findings 💀












