Gno.land, the Go-based smart contract platform developed by NewTendermint, has introduced Dora, an autonomous AI agentic security system that continuously examines the platform's codebase and its smart contracts, known as realms.

Unlike conventional security tools, which flag potentially vulnerable code for later investigation, Dora is built to establish whether a suspected weakness can actually be exploited. Before any finding reaches a human reviewer, the system reproduces the suspected exploit against a live Gno.land node — an approach intended to reduce false positives and surface actionable vulnerabilities earlier.

The launch reflects a broader shift among blockchain projects toward agentic artificial intelligence for continuous security monitoring, instead of relying primarily on periodic audits or vulnerabilities reported through bug bounty programs. The stakes behind that shift are visible in industry loss data: security trackers such as Chainalysis and Immunefi have reported multibillion-dollar annual losses from crypto hacks in recent years, with vulnerabilities in smart contracts among the recurring causes. Conventional audits are also point-in-time assessments, and code that changes after an audit is completed can remain unreviewed until the next engagement — a gap that continuous monitoring is positioned to narrow.

Gno.land was founded by Jae Kwon, co-creator of Cosmos and Tendermint. The platform uses Gno, an interpreted and deterministic variation of Go, and is designed to let developers write readable, composable smart contracts while requiring source code to remain publicly available on-chain — an architecture intended to improve transparency and make contracts easier for developers and security researchers to inspect. NewTendermint, which is led by Kwon, develops infrastructure for decentralized systems, including Tendermint2 and Gno.land, and serves as a core maintainer of the Gno.land protocol and GnoVM, supporting open-source infrastructure intended for permissionless applications.

Seven-agent process targets exploitable vulnerabilities

The need for continuous verification has grown as artificial intelligence has made suspicious code easier to identify. AI-assisted tools can quickly locate potentially problematic sections of software, but determining whether those issues are genuine, exploitable vulnerabilities remains more difficult — and the same capabilities are increasingly accessible to both security teams and potential attackers.

For blockchain networks, the consequences of an undetected software defect can be significant. A panic in a critical component could interfere with consensus, nondeterministic behavior could cause validators to diverge, and arithmetic errors could potentially affect asset transfers.

Dora addresses this challenge through a seven-stage agent workflow covering reconnaissance, vulnerability planning, deduplication, verification, adversarial review, patch development and final fix validation. The reconnaissance agent maps the relevant code, while the planning agent develops potential vulnerability scenarios. A deduplication stage removes issues that are already known. The verifier then creates and executes a live test against an actual Gno.land node to determine whether the suspected weakness can be reproduced.

A separate reviewer evaluates the result from an adversarial perspective. If the issue remains valid, a fixer prepares a patch, followed by another review to determine whether the proposed correction resolves the vulnerability without introducing a new problem. Only findings that pass the complete process are forwarded to human reviewers.

Gno.land expands AI-focused development tools

Dora forms part of Gno.land's broader effort to integrate artificial intelligence into both development and security processes. The platform has also released gnomcp, an open-source server intended to connect AI coding agents such as Claude Code and Cursor directly with Gno.land. Through that integration, AI agents can interact with Gno.land to read, write and deploy realms using development workflows familiar to software engineers. The platform's use of human-readable, Go-based smart contracts is also intended to make its code more accessible to AI systems compared with architectures where application logic is represented primarily as compiled bytecode.

Dora is currently an internal security tool, and Gno.land has not yet completed a comprehensive audit of its entire codebase, although targeted testing has already generated reproducible findings with relatively low noise. The company plans to expand Dora's coverage and publish additional results as the system is deployed more broadly. As those findings become public, independent security researchers will be able to check whether the system's reproducible results hold up under outside scrutiny — an early test of agent-driven verification as a standard security practice. The initiative could provide Gno.land with a continuous security layer that complements traditional audits and human-led vulnerability research, while allowing confirmed issues to be addressed before they are discovered externally.

Source: CoinTrust