Arbitrum Security Council Halts New Stylus Activations Following AI-Assisted Attack Risks

The Arbitrum Security Council initiated an emergency action on October 2 to restrict new Stylus contract activations on both Arbitrum One and Nova. This measure specifically targets programs and application updates that require fresh activation to become executable.

Arbitrum stated the decision was a precaution against increasingly sophisticated AI-assisted attacks. These threats involve hand-crafted WebAssembly programs created outside the standard Stylus compiler toolchain. The Council noted that while known Stylus bugs pose risks to chain liveness and could lead to denial-of-service, there is no evidence of any attack resulting in the theft of user funds.

The restriction does not affect ordinary Solidity contract deployment or execution. Existing Stylus applications that are already active may continue to run, and developers can still use the permissionless keepalive renewal mechanism to extend the lifetime of active programs before they expire. However, the Council has blocked the reactivation of expired programs or those requiring fresh activation due to version changes.

To implement this, the Council raised the gas requirement for activation to a prohibitively high level. This configuration change did not require an upgrade to the network's operating software, ArbOS.

In addition to the Stylus restrictions, the emergency action introduced a safeguard for BoLD one-step proofs on Arbitrum One. This mechanism allows the system to pause settlement to Ethereum if it detects two conflicting answers to the same step of an open challenge. While the chain would continue to process transactions normally during such a suspension, unconfirmed withdrawals and other messages to Ethereum would be delayed until the Council implements a fix.

The Arbitrum Foundation plans to coordinate with the ArbitrumDAO to determine the timeline and process for restoring Stylus activations. No specific date for the restoration has been provided.