Given Enough Agents

• Review was always the scarcity
• You can now buy the scarce thing
• How to do it
• Verify before you file
• Diversity is the coverage
• Pick up the shovel

Given enough eyeballs, all bugs are shallow. Eric Raymond’s sentence carried the security argument of free software for three decades: publish the source, and the reading public becomes the quality department, since any reader could catch what the author missed. Permission to inspect was the prize that had to be won, and it was won so completely that the movement forgot to ask who would do the inspecting.

Coldcard answered the question: its seed-generation flaw sat in public source for five years before an unknown party exploited it to sweep roughly 1,367 BTC in July 2026. Readability is a property of an artifact. Review is an act, performed by someone, for a reason, with the capacity to understand what they see.

§Review was always the scarcity

The historical record is consistent on this point. Heartbleed lived for two years inside the internet’s most deployed encryption library and surfaced only when two funded security teams looked. Log4Shell survived eight years in one of the JVM’s most common dependencies until an Alibaba Cloud researcher traced a dangerous composition of individually plausible features. The xz backdoor, engineered specifically to defeat source inspection, was caught by a PostgreSQL developer whose SSH logins ran 500 milliseconds slow and who chased the anomaly with Valgrind. Coldcard’s entropy flaw sat in public view for five years. Deployment never produced review. Motivated, capable, independent review produced it, and that kind of review was always scarce, because the number of people who can read security-critical code with understanding was always small.

§You can now buy the scarce thing

What changed is that understanding no longer requires you to be one of those people. You tell your agent to read the code, and it reads, compiles, tests, traces, and reports. The capability already produces results at industrial scale: Google’s Big Sleep found a previously unknown exploitable memory bug in SQLite in October 2024, and Anthropic’s coordinated disclosure ledger records 1,596 Claude-discovered vulnerabilities across 281 open-source projects as of May 2026, with 90.8% of externally reviewed findings confirmed valid. Adversaries hold the same flood, so the first consequence is defensive: keep your stacks updated and patch on a schedule, because the window between disclosure and exploitation is compressing.

For the enthusiast, though, the second consequence is the one this post exists for. The excuse “I cannot code, so I cannot contribute to the free software I rely on” held for thirty years and is now false. A focused audit pass over a mid-size repository consumes roughly a million input tokens and fifty thousand output, which at current API rates costs between 4,000 and 6,000 sats. A monthly whole-repo scan runs 8,000 to 25,000 sats. Steady review of twenty pull requests a month costs 15,000 to 45,000 sats. For the price of a coffee subscription, aimed at the code that guards your savings, you become a reviewing party in the projects you depend on.

§How to do it

Start simple. Pick one project you rely on and whose code you cannot read fluently: the firmware signing your transactions, the node validating your coins, the client carrying your messages. Give Claude Code, Codex, OpenCode, or whichever agent you already run the repository and ask for a security audit, letting the agent research current methodology itself and propose its own checklist. Read what returns. Your first pass will produce more questions than findings, and tuning the prompt against what you learn is part of the work.

Then automate. An autonomous agent such as Hermes or OpenClaw turns the one-off audit into a standing review: a cron job that checks out the repository on a schedule, scans the full codebase, reviews every new pull request against the project’s history, reproduces candidate findings, dedupes against its own prior runs, and files what survives. Ongoing coverage catches the class of bug that a single audit cannot, because most real vulnerabilities enter through ordinary changes reviewed by ordinary schedules.

Publish everything that clears verification. Comments and issues on GitHub or Ngit put the result of your sats into the hands of the developers, and they leave a publicly visible trail showing that more eyes are on this code, which raises confidence in the project itself. GitHub’s own security workflows already file public issues from nightly agent scans, and Anthropic’s ledger posts hash commitments before disclosure. Bitcoin Core’s Review Club shows what a durable human trail looks like; your agent’s trail should look the same. The visibility is half the contribution.

§Verify before you file

Cheap reports are the failure mode of this new arrangement, and curl shows the cost. By July 2025, Daniel Stenberg reported that roughly 20% of curl’s security submissions looked like AI slop while 5% described real vulnerabilities, each false report consuming three to four maintainers for up to hours; curl ended its paid bounty after January 2026 because rewards had created incentives to “find and make up ‘problems’.” The models confess the same limit from the other side: presented with real and fabricated CVE identifiers, LLMs produce plausible advisories for both at rates above 95%, and on real files the best models identify the exact vulnerability 17 to 24% of the time. Fluency is free and carries no signal.

The answer is to spend your tokens on verification, and to let the agent do the verifying. When a scan returns a candidate, point the agent back at it with instructions to prove or kill it: reproduce the behavior against the real build, write the failing test, trace the input path to the exact file and line, check whether existing issues already cover it, and attack its own conclusion from the maintainer’s side. Most candidates die under that treatment, which is the point. Every false positive you kill in your own pipeline is maintainer time you did not spend, and the false positive rate is the difference between a reviewer projects welcome and a noise source they learn to filter. File what survives: the test, the trace, the proof of concept, the location. A plausible narrative is a draft, and a cheap one. The verified report is the contribution your sats are paying for.

§Diversity is the coverage

If every enthusiast defers to one red team or one model, the blind spots correlate. The N-version experiments of Knight and Leveson showed that nominally independent implementations repeat the same mistakes, because independence of effort guarantees nothing about independence of failure modes. Ten copies of one model are one auditor. Different models, prompts, environments, scanners, and goals ask different questions, and the question inventory is what coverage means. The xz backdoor fell to one man’s peculiar machine and a runtime measurement. KyberSlash fell when one side-channel insight was carried across many independently maintained implementations. Many small auditors, each strange in their own way, cover ground that one centralized team will never staff.

Bitcoin’s own volunteer red team shows the model working: sixteen reviewers distributed across the globe, scanning repositories across hundreds of Bitcoin projects and filing thousands of AI-assisted findings, with critical reports reproduced locally before disclosure. Credit where it is earned; that is the shape of serious defensive work. It is also no excuse for your own absence. Sixteen reviewers, however good, share prompts, habits, and blind spots, and the whole point of the arrangement is that your setup asks questions theirs does not. Join the coverage.

§Pick up the shovel

The incentive shape is the one that always worked, now extended to individuals. You want your own tools to work. Your wealth sits behind that firmware and your privacy behind that library, so spending sats to audit the code you depend on is aligned self-interest with the cost collapsed. Goodwill was always available and rarely scheduled; self-interest shows up on cron. Set up your agents and point them at the software you rely on. Verify what returns, file what reproduces, and publish it where the world can see, so developers receive the work and the public record shows the code is being watched. A decentralized society of reviewers, each auditing in their own way with their own sats on the line, solves the oldest staffing problem in free software. The shovel costs a few thousand sats. Dig.