Arbitrum’s Security Council enacted an emergency measure on October 2, 2026, suspending new Stylus contract activations across Arbitrum One and Nova. The action, taken around 11:30 a.m. ET, responds to growing risks from sophisticated AI-assisted attacks that exploit hand-crafted WebAssembly programs built outside the standard Stylus compiler toolchain.

How the Pause Was Implemented

Rather than requiring a software upgrade to ArbOS, the Council raised the gas cost for Stylus contract activation to a level described as prohibitively expensive. This configuration change immediately prevents new activations without altering the underlying protocol. Existing Stylus contracts remain fully operational and can continue executing. Developers may still extend active programs through a permissionless keepalive renewal process before expiration. However, any contract needing a first-time activation, reactivation after expiration, or a new application version requiring fresh activation is blocked.

Ordinary Solidity contract deployment and execution on both networks continue without interruption. The intervention is limited strictly to Stylus activations and leaves the bulk of Arbitrum activity, including DeFi protocols and standard dApps, running normally.

Nature of the Identified Threats

The Security Council cited increasingly advanced AI-assisted attacks that generate custom WebAssembly bytecode designed to bypass the usual Stylus compiler safeguards. These programs target edge cases that standard tooling would typically prevent. The primary risks involve potential disruption to on-chain activity and denial-of-service conditions that could affect network liveness. Officials confirmed that no vulnerabilities allowing theft of user funds have been identified, and no such attacks have occurred.

Stylus enables developers to deploy programs written in languages that compile to WebAssembly, expanding beyond traditional Solidity. The pause specifically addresses programs created with nonstandard toolchains, leaving validated and already-activated code untouched.

Additional Safeguard for BoLD Dispute Resolution

Alongside the activation pause, the same emergency action introduced a protective measure for Arbitrum One’s BoLD one-step proofs. BoLD handles dispute resolution during the chain’s challenge periods for settlement to Ethereum. The new guard activates if two contradictory answers are submitted for the same step and both are validated by the one-step proof system. In that scenario, settlement from Arbitrum One to Ethereum is temporarily held, allowing time for a fix.

Arbitrum One itself continues processing transactions as usual under this condition. The potential impact is limited to messages, including withdrawals, that have not yet been confirmed on Ethereum. Those pending transfers could experience delays until the Council resolves any conflict and restores normal settlement. The guard does not pause withdrawals by default; delays occur only if the specific contradictory-proof situation arises.

Path Forward for Stylus Activations

No specific date has been set for lifting the restriction on new Stylus activations. The Arbitrum Foundation will collaborate with the ArbitrumDAO to determine both the timing and the method for restoring the ability to activate new contracts. Until that decision, teams with live Stylus applications can maintain operations and renewals, while those preparing new deployments or major version updates must wait.

The measures leave the majority of network functions intact while addressing targeted risks to stability. Developers and users of Arbitrum One and Nova face no interruption to existing Stylus contracts or standard Solidity activity during this temporary period.