Arbitrum Pauses New Stylus Activations After AI-Assisted Attacks

Arbitrum has paused new Stylus contract activations on Arbitrum One and Nova after AI-assisted tooling made attacks against hand-crafted WASM programs easier to build. The change blocks new deployments, but it does not stop existing Stylus contracts from running or users from interacting with them.

The Security Council completed the emergency action at 11:30 EST on 2 October 2026. It also added a guard for Arbitrum One’s one-step proof of BoLD, the system used to confirm the chain’s state before settlement to Ethereum.

Why Arbitrum Paused Stylus

Stylus lets developers deploy contracts as WebAssembly programs rather than relying only on the standard EVM path. Those programs usually pass through the Stylus compiler toolchain, but the attack described by Arbitrum used hand-crafted WASM that bypassed it.

AI-assisted tools have made it possible to produce more sophisticated attacks, according to the Foundation. The programs were designed to behave unexpectedly, including degrading chain performance for other users. No attack that enables the theft of user funds has been found.

Recent ArbOS releases patched several reported bugs and known attacks. The pause is meant to prevent developers from activating new hand-crafted WASM programs while the network may still be exposed to unpatched variants.

This is a narrow response to a narrow entry point. Arbitrum says the known Stylus bugs mainly threaten chain liveness, meaning the network’s ability to keep processing transactions. A denial-of-service attack can make that difficult even without taking a user’s funds.

Existing Contracts Keep Running

The pause applies to activation, not use. Already-active Stylus contracts will continue to execute until they expire, and users can still call them. Developers can also renew active contracts through the existing permissionless keepalive process.

That distinction matters for users. The pause does not freeze applications already built with Stylus, nor does it shut down their onchain activity.

There is, however, a gap between using an active contract and deploying a new one. A new contract cannot be activated while the pause is in force. That also blocks a new version of an existing application if the version needs activation.

Renewing an active contract is another matter. The ArbOS 61 upgrade renewed every active contract on Arbitrum One, so none will expire before 20 August 2027. Reactivating a contract after it expires, or updating one after a Stylus version change, remains paused.

Solidity development is unaffected. Deploying and executing Solidity contracts through the EVM continues as before.

The Gas Setting Makes It Expensive

Arbitrum did not switch Stylus off with a new network release. Instead, the Security Council changed one configuration setting on each chain by calling ArbOwner.setWasmActivationGas with a value of 2^64 - 1.

That raised the gas required to activate a Stylus contract to a level intended to make new activations effectively unusable. As a configuration change, it did not require an ArbOS upgrade or a separate external audit.

It is a slightly unusual way to pause a feature. The activation path still exists, but the price of using it has been pushed beyond practical reach. Re-enabling normal activation will require a later configuration decision, with no timeline yet set.

A Second Guard for BoLD

The second part of the action protects Arbitrum One’s one-step proof of BoLD. The new OspSoundnessGuard can receive two conflicting answers to the same step of an open challenge.

If the one-step proof accepts both answers, the guard pauses settlement from Arbitrum One to Ethereum. In ordinary terms, the network stops finalising its state to Ethereum until the conflict is resolved.

This role is deliberately limited. A new PauseExecutor contract can pause the guard and do nothing else, while the guard receives the permission needed to use that function. Arbitrum says the guard contracts received an external audit.

The Foundation describes this measure as precautionary. Its forum post does not say whether the one-step proof issue was exploited in production.

What Developers Should Expect

The immediate effect is on deployment rather than use:

• New Stylus contract activations are paused on Arbitrum One and Nova.
• Existing Stylus contracts continue to execute and can be renewed.
• New versions requiring activation cannot go live during the pause.
• Solidity and EVM deployment remain unaffected.
• Calls to already-activated contracts remain open to users and developers.

Arbitrum will work with ArbitrumDAO on the timing and method for restoring activations, but no end date has been announced. The Foundation has not disclosed the number of affected contracts, their combined value or any projects caught by the restriction.

That leaves a clear trade-off for developers. New Stylus deployments must wait while Arbitrum checks the attack surface. Users, meanwhile, do not need to withdraw from active contracts because of the pause itself: the contracts remain live, their renewals continue, and the known attack described by Arbitrum is aimed at chain availability rather than fund theft.