The report
EVAge pushes autonomous EVM security research into a different part of the attack surface. Instead of starting with a known vulnerable contract and asking an agent to produce an exploit, the system searches, implements and adapts strategies around transaction ordering, liquidity and MEV.
The September 23 EVAge paper describes a hierarchical multi-agent harness with separate collection, construction and validation roles. Within an EVAge run, those agents generate and repair MEV-bot code while a deterministic validator executes candidate plans against historical EVM state using Anvil forks.
That execution boundary matters. The final result is not accepted because an LLM says a strategy should work. The validator has to produce a concrete execution trace in which the intended transaction sequence completes and yields positive net revenue.
More than 1.5 million historical blocks per chain
The authors evaluated the system on more than 1.5 million historical blocks from each of Ethereum, Base and BNB Smart Chain, covering data from February through August 2025.
On Ethereum, the implementation spans constant-product AMMs, concentrated-liquidity markets and Balancer V2. The authors report 11 strategy implementations across those protocol families. They also adapted six CPMM strategies from Ethereum to BNB Smart Chain and two backrunning strategies to Base.
Base is an instructive limitation rather than a clean success story. Because its private mempool does not expose the same pending-transaction surface needed by sandwich-style strategies, the paper restricts its Base experiments accordingly.
The broader result is that the agent harness is not merely rewriting the same bot for another contract address. It has to modify protocol interaction, state collection, planning and validation logic while retaining the economic structure of the strategy.
Five generated variants, with an important novelty caveat
EVAge reports five generated strategy variants: SBA-HFT, JIT-HFT, BUR-HFT, LR-HFT and MLL-HFT.
The paper describes these as novel variants, but that should not be read as five entirely new MEV primitives invented from nothing. The underlying HFT sizing and search algorithm already existed. EVAge's contribution was to recognize that the technique could be transplanted or combined with other MEV structures and then generate working implementations around those combinations.
That is still a meaningful automation result. It shows an agentic system moving from reproducing a known strategy toward searching a nearby design space, implementing candidate combinations and using execution feedback to determine whether they work.
The multi-agent harness materially outperformed the paper's simpler baseline
The paper also includes a 10,000-block BSC ablation using HFT, sandwich and JIT strategies. The specialized EVAge harness found 4,546 profitable replay cases totaling 31.17 WBNB. The paper's pipeline-structured single-agent baseline found 109 cases totaling 3.81 WBNB.
The authors attribute much of that difference to specialization: candidate collection, chain-specific planning and validation diagnostics are handled by different roles rather than compressed into one agent context.
That comparison is evidence about the authors' experimental harness. It is not a measurement of how much money an autonomous attacker could make on BSC today.
Historical revenue is not realizable attacker profit
The profitability numbers need unusually strong qualification.
The experiments use historical replay and assume effectively unbounded attacker capital. Gas is deducted, but the evaluation does not fully model competition with other searchers, private-relay submission, asset acquisition and conversion, flash-loan repayment or builder bribes.
The paper therefore describes an opportunity surface under controlled assumptions, not a ready-made revenue forecast.
Some generated approaches also fail badly under particular market structures. The authors report that the HFT-style ternary search can perform poorly where liquidity curves are not suitably shaped. BUR-HFT's Balancer V2 simulation success falls to 1.45 percent, with victim-slippage constraints accounting for many failures, while MLL-HFT can underperform its parent strategy when optimization converges too early.
Those failures are useful evidence because they show that the system is not simply labeling every generated variation a success.
The agents are offline; execution remains deterministic
EVAge does not place an LLM directly into the latency-critical transaction path. The agents generate and refine strategy code offline. The resulting planner is deterministic, and the paper separately measures its execution latency.
That architecture separates two questions that are often collapsed in discussions of autonomous trading agents: whether an AI system can design an attack strategy, and whether an LLM can react quickly enough to participate directly in a live block-building race. EVAge primarily addresses the first.
No live attack is reported
The experiments ran on isolated forks using public ledger data. The authors state that they did not broadcast the generated transactions, use production credentials or cause financial losses.
The paper also describes a tiered release policy. High-level architecture, agent reasoning components and defensive-analysis material are intended to be available, while execution components considered directly reusable for live mempool exploitation remain restricted.
That leaves an important verification boundary. EVAge is currently evidence that a multi-agent system can generate, repair, combine and migrate MEV strategies under controlled historical replay. It is not evidence that those strategies were deployed against users, nor is the current record an independent reproduction of the authors' results.
The security significance is narrower but still substantial: autonomous EVM exploitation research is moving beyond asking whether an agent can turn a known bug into a proof of concept. Systems are beginning to search the economic attack space itself, generate implementations and use deterministic execution feedback to refine what they build.