Multi-agent AI smart contract security. Built for deeper vulnerability detection. Trusted by @1inch, @LidoFinance, @GearboxProtocol
Joined March 2023
- Tweets3.4K
- Following200
- Followers591
- Likes3.9K
Pinned Tweet
SavantChat is #1 on EVMBench: 112 of 117 high-severity bugs found, 95.7% recall.
The best frontier model in the EVMBench paper found 45.6%. We ran all 117 issues through EVMBench’s own grader, one verdict per report with no re-runs, and a bug only counts when the mechanism, the code path, and the fix all match.
The same engine is the one auditing your code today, from the contract to the backend around it.
Every report and every verdict is public, so you can check each one yourself: savant.chat/evmbench
SavantChat is #1 on EVMBench, with 112 of 117 high-severity bugs found.
Good moment to answer the question we hear often: who is this for? Auditors, sure. But the list is a lot longer than that, and some of it might surprise you.
Who we build for, one role at a time 🧵
12/ Grant programs and ecosystem funds
You fund dozens of teams a quarter and can't afford a manual audit for each of them.
A grants program can run every grantee's repo through SavantChat before a milestone payout and send the team its findings to fix. It turns "we hope they're secure" into a checklist, and the grantees get a free security review out of it.
Found yourself in this thread? Start with $75 in free credits, no card required, and see what SavantChat finds in your code.
savant.chat
We’ll be in Mumbai Nov 1-6 for @summit_defi and @EFDevcon 🇮🇳
@alexgulamova and @igorgulamov will be there all week, and their DMs are open if you want to meet over chai and talk security or AI audits.
Igor is packing something for DSS that goes one layer below the contract. Details soon.
Mumbai, we’re coming. Keep the vada pav warm 😅
Less than 2 weeks until Devcon 8!
✈️ Devcon welcome booth at Mumbai airport
🚇 Metro access to Jio World Centre
🪔 Diwali lands right after, so book your stay asap to experience the magic
Travel guide → devcon.org/en/travel-guide
Devcon 8 Tickets → devcon.org/tickets
Savant.chat retweeted
Just finished the @StellarOrg hackathon.
Implement custom frontend for Soroban contracts with back by @savantchat
Links belowe
We pointed SavantChat at PHP before the PHP2Shell patch, with no hints about where to look. It found the out-of-memory bug behind CVE-2026-109618 on its own and proved it with a working PoC.
The table counters move before memory for the key is allocated, so when memory runs out mid-request, cleanup later walks over a slot that was never filled in and corrupts memory.
If it can find this in the C core of PHP, it can find what’s hiding in your backend or your contract.
savant.chat
Cloudflare saw thousands of PHP2Shell exploit attempts in the 10 hours before the bug was officially announced. The vulnerable code dates back to PHP 5.4 from 2012, and attackers were hitting it before most defenders knew it existed.
Update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, since 8.1 and older get no patch, and watch PHP’s advisories. Researchers are reporting a double-free on 8.5.12. It isn’t confirmed as RCE, but the fix may be incomplete.
A bug in your own PHP app or backend gets no CVE, and nobody will post attempt counts for it. Scan that code with AI before an attacker finds the hole. On Advanced and Pro, SavantChat confirms each finding with a working proof of concept.
savant.chat
The internet spent this week on PHP2Shell and on critical CVEs going parabolic. Meanwhile, the SavantChat team went under the hood and upgraded the models that do the actual thinking inside our agent.
▸ Frontier models: the components that search for attack hypotheses and filter out the false ones now run on the latest frontier releases, so every model update turns into better reasoning for your audit.
▸ Supporting models: the smaller models that handle helper tasks inside the agent got upgraded as well.
▸ Pipelines and prompts: rebuilt around the new models, so each step gets the context it needs and nothing extra.
Next up is triage: we’re reworking the module that rates every confirmed finding from Critical down to Info, so the severity in your report matches the real risk. More on that soon.
Until this week, every SavantChat audit started with someone opening savant.chat. Now it can start with one line to the coding agent you already work with, and the engine got sturdier on the repos that used to trip it up.
▸ Agent API keys: create one under Settings › API keys, choose who it acts for, what it may do and an optional expiry, then give it a monthly spend limit.
▸ SavantChat in Claude Code, Cursor and Codex: paste the setup prompt into your agent and it can price an audit, start one up to a price cap, track it and read the findings, straight from its working copy with no GitHub needed.
▸ Repos that mix Foundry and Hardhat are now accepted, and Foundry projects keep going when their own tests need network access or already fail.
▸ .NET and TypeScript audits got a round of setup fixes, so they no longer stop early or finish having examined nothing.
▸ One failing area or finding no longer cancels the whole audit, and repos past 2,000 auditable files now import while you uncheck folders until it fits.
▸ Plus smaller fixes across checkout, the commit picker and the GitHub connect flow.
So the loop now looks like this: your agent writes the feature, sends it to SavantChat under the cap you set, and the findings are waiting before you merge.
Give it a try on your next PR.
Cloudflare saw thousands of PHP2Shell exploit attempts in the 10 hours before the bug was officially announced. The vulnerable code dates back to PHP 5.4 from 2012, and attackers were hitting it before most defenders knew it existed.
Update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, since 8.1 and older get no patch, and watch PHP’s advisories. Researchers are reporting a double-free on 8.5.12. It isn’t confirmed as RCE, but the fix may be incomplete.
A bug in your own PHP app or backend gets no CVE, and nobody will post attempt counts for it. Scan that code with AI before an attacker finds the hole. On Advanced and Pro, SavantChat confirms each finding with a working proof of concept.
savant.chat
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.