Arbitrum pauses new Stylus activations over AI-assisted attack risks

Arbitrum’s Security Council instituted a temporary block on fresh Stylus contract activations across Arbitrum One and Nova during an October 2 emergency intervention. This limits programs and application updates that depend on new activation. The Council’s report notes that currently active Stylus applications continue to function normally, and standard Solidity contract deployment and execution remain entirely unaffected.

Arbitrum explained that the precaution is a response to more advanced, AI-assisted attacks utilizing hand-crafted WebAssembly programs built outside the standard Stylus compiler toolchain. The network stated that known Stylus bugs primarily endanger chain liveness—such as introducing denial-of-service risks—and emphasized that investigators found no exploits allowing the theft of user funds.

Transaction records linked for Ethereum, Arbitrum One, and Nova confirm successful execution on October 2, occurring roughly between 15:30 and 15:31 UTC.

For developers, the operational difference lies between simply storing code and rendering it functional. Stylus contracts execute WebAssembly programs, which require activation before they can run. Arbitrum’s documentation separates this phase from deployment, which merely stores code onchain. Furthermore, new contract instances utilizing identical program code can leverage an existing activation as long as it remains valid.

According to the Council, any fresh application version requiring new activation cannot be made executable throughout the duration of the pause. The restriction also blocks reactivating expired programs or those needing renewal following a Stylus version update. Consequently, the measure targets activation specifically rather than imposing a blanket ban on deploying every new contract instance.

Existing programs stay callable until they expire. The official pause notice outlines that developers can still extend an active program’s lifespan via the permissionless keepalive renewal mechanism prior to expiration. While renewal remains open, activating an already-expired program stays blocked.

The Council enforced the restriction by elevating the activation gas requirement to a cost-prohibitive level. This adjustment was characterized as a configuration change that requires no upgrades to ArbOS, the operating software of the network.

When withdrawals could wait

The same emergency measure introduced a separate safeguard for BoLD’s one-step proofs on Arbitrum One. Under this system, any participant can submit two conflicting answers regarding the same step within an open challenge. The Council explains that if the one-step proof accepts both, the guard temporarily pauses the settlement of Arbitrum One to Ethereum.

Arbitrum clarifies that Arbitrum One will proceed with standard processing during any such suspension. Nonetheless, unconfirmed messages moving from One to Ethereum—including withdrawals—would experience delays while the Council deploys a remedy and restores settlement. The deployment of the guard itself does not automatically halt withdrawals, as any delay relies entirely on the conflict condition being satisfied.

For builders waiting to activate new Stylus code, the timeline for reopening remains undetermined. The October 2 report and developer notice provide no specific date, noting instead that the Foundation will collaborate with the ArbitrumDAO to determine the schedule and method for restoring activations.

?Frequently Asked Questions

01Why did Arbitrum pause new Stylus activations?

Arbitrum’s Security Council paused new Stylus contract activations due to rising concerns over sophisticated AI-assisted attacks utilizing hand-crafted WebAssembly programs created outside the standard Stylus compiler toolchain.

02Are existing Stylus and Solidity contracts affected?

Already-active Stylus applications can keep running, and ordinary Solidity contract deployment and execution remain completely unaffected by the action.

03How was the restriction implemented?

The restriction was enforced by raising the activation gas requirement to a prohibitively expensive level, functioning as a configuration change that required no upgrades to ArbOS.

04What happens to withdrawals during the BoLD safeguard event?

Unconfirmed messages from Arbitrum One to Ethereum, such as withdrawals, would be put on hold if a specific conflict condition is met, requiring the Council to deploy a fix before settlement resumes.