Anthropic,OpenAI,Cloudflare和Google现在各一艘AI agent在源代码中猎取安全错误。 我们检查了每架车的背面证件和技术细节
关键发现：所有4个工具都集中在一个设计上。 一个agent 发现 a bug，一个单独的agent试图反驳它，只有幸存者才能得到补丁。 差异在于它们运行在何处，谁可以使用它们以及它们需要多少证据。
关键外卖
- 4个实验室，1个模式：找到，独立反驳，然后补丁。
- Claude安全运行在Claude Code内部；不需要额外的API密钥。
- Codex Security的CLI是Apache-2.0，但扫描仍需要OpenAI访问。
- Cloudflare的技巧是麻省理工，模型-不可知论和最有星等为47.5K.
- Google的螳螂在沙盒中再生虫；Google 称将其隔离。
为什么4个实验室在2026年运送同样的东西
每一个问题都在于噪音。 Google的安保团队写道，草率的AI代码扫描会产生幻觉的bug和真实阳性率低于7%. 扫描仪误差了93%的时间使审查人员付出了比节省更多的代价
共同解决是职责分离。 agent，报告一个发现从来没有得到确认。 Cloudflare在其README中直接声明了这个规则：核查者永远不是发现错误的agent. Anthropic,OpenAI和Google各自描述一个类似的验证步骤，然后才能得到报告。
第二车手是违法的 Anthropic小组说，它建造了扫描仪，部分原因是攻击者已经在使用AI模型来发现可开发的缺陷，按Hacker News计算。 Google打开了它的螳螂帖子，指出模型现在可以在很少的人类帮助下发现和利用虫子。
1. Claude安全由Anthropic
它是什么：一个多agent脆弱性扫描仪，运行在Claude Code会话内。 它是Anthropic托管的Claude安全产品的本地版本，按照插件README进行。
如何运作：Agents绘制了建筑图，构建了威胁模型，猎取了每个组件并独立验证了每个发现。 该插件从一个菜单中提供3个工作：扫描代码库，扫描修改，或建议补丁，每Claude Code Docs.
输出：一个Markdown报告连同一个用于GitHub代码扫描的SARIF 2.1.0文件。 每个发现都带有严重性，一个CWE类，影响和复制步骤。 补丁在抓取副本中被起草并登陆为F<n>.patch文件。 插件从不自行执行、推动或打开拉动请求。
费用和准入：它没有自行制作的模型调用，所以没有单独的API键。 扫描数与您的 Claude 计划的使用限值相对应。
/plugin 安装 claude- 安全@ claude- plugins- 官方
/claude-安保
时间线：Anthropic于2026年2月打开了名为"Claude Code安全"的有限预览。 该主机产品在Claude Opus 4.7上为Enterprise 客户达到公用β. Claude Code插件于2026年7月22日输入β，由网络安全新闻公司提供。 8月，主机扫描仪转移到了Claude Mythos 5，每台Dataconomy.
Anthropic将其定位为一层。 安全指导插件检查代码为 Claude 所写，和/ 安全审查进行一个分支的单传。 Claude 坐标安全是点播深度扫描
2. OpenAI的编码安全
它是什么：一个CLI和TypeScript SDK，作为@openai/codex-security发布，用于查找，验证和固定弱点。
如何运作：它扫描整个Repo，所选路径，或Git diff. – 模度深旗运行平行发现工人。 它验证了候选结论，生成了补丁并可以验证现有的修正。 一个cs的政策命令起草一个Security.md，告诉未来扫描什么是您项目中的一个弱点。
输出：威胁模型，SARIF,JSON或CSV导出，再向Linear发布。 它可以导入GitHub代码扫描警报，并从Git历史中推荐出所有者。 GitHub 时速动作运行排程或拉请求扫描；结果默认只报告。
npm 安装 -- global @ openai/ codex 安全
cs 登录
cs扫描成本和访问：客户端为Apache-2.0，但背后的扫描仪不是。 DevOps.com 指出 CLI和SDK在被批准的客户停留在有限的β. README将OpenAI,Amazon Bedrock,OpenRouter和Fireworks AI列为提供商。 需要节点.js 22.13+和Python 3.10+.
3. Cloudflare的安全审计技能
麻省理工学院有执照的技艺能把agent编码成安全审计师
如何运作：六阶段审计：
- 侦察：地图结构、信任界限和输入到架构.md和覆盖分类账。
- 以覆盖为主导的狩猎：孤立的猎人各取分类账单位；覆盖批评者寻找缺口。
- 候选人验证：一名新的核查员试图反驳每个独特的候选人。
- 结构化产出：确认、需要、验证和拒绝记录到结果。
- 独立记录核实：新的agents重新核实所有最后来源索赔。
- 目标中性报告：报告和详细档案取自经核实的记录。
要求：一个支持工具使用和平行子agents的编码agent，外加用于验证器的节点.js. 它还想要一个没有外部网络的OS强制沙盒。 没有一条线索，线索需要验证而不是被执行。
npx技能添加 https://github.com/cloudflare/security-audit-skill-skill-security-audit
然后问agent:“安全审计这个密码库。” 输出默认为~/security-audit-skill/<repo-name>/run-<N>，位于您的repo之外。
其背后的数据：Cloudflare于2026年6月18日公布了该技能，并用其后作"Build your own faility language". 大约450行的技巧植入了内部的绳索，现在扫描了128个接头。 Cloudflare报告这些寿命数：
- 发现的20 799个原始候选人，其中12 057个在验证中幸存。
- 145套共用分流池的13 841个发现，包括另一套抽取物。
- 5 442起折叠为重复，1 154起折叠为错误收回或低风险。
- 7 245项可采取行动的发现送交工程小组。
更好的搜索环境将首发拒绝率从40%降低到11%. Cloudflare也使用一个模型来进行发现，并使用不同的模型来进行分解，因此模型互相检查。
4. Google公司
是什么：Apache-2.0系列安全审查技能外加用于AI编码agents的ADK参考管。 Google团队表示，这是发现内部如何修复bug的一部分。
如何运作：螳螂阅读Repo的历史，它建立分级摘要树，将文件收缩成目录和根摘要。 Google团队表示，这个剪接符的间接费用超过85%. 然后产生威胁模型和假设、狩猎、重复和批评结论。
是什么使它分裂：复制和补丁验证。 螳螂试图复制每个bug，从静态的活化素描到单位测试或模拟服务器。 它与攻击固定点的对抗循环相接。 也把严厉程度比作“千分百的批评 ”。 然后把学到的知识反馈到代码生成中
设置：克隆回波并指向它上的任何编码agent，或者直接运行ADK吊带。 绳子支持“寻找IDOR”和“最大托盘”等焦点快取。
git Clone https://github.com/google/mantis.git (英语).
cd 螳螂/参考。/install.sh
./运行.sh 路径/到/代码
边来边去
超越了大4：其他AI捕虫者发布在2026年
2026年至少有12个基于agent的脆弱性工具被运出或公开。 几乎所有的都重复同样的查找-当时的独立验证循环。 他们分成自由的拉带你运行自己和商业或内部平台。
开源带
AppSec Santa也追踪来自Anthropic(defending-code-Reference-harness),"比特"(Trail of Bits),"资本一号"(vulnhunter)和"思科"(ai-dep-sast)等地的吊带。 Cisco在Foundation-Sec-8B上运行
商业平台和内部系统
这种模式存在于销售商之间：确定性引擎或验证器进行验证，模型进行推理，以及人批准每一个固定。
哪个先跑
- 已经在Claude Code上：从Claude安全插件开始。 它安装在1行并使用您现有的计划。
- 在GitHub需要CI GATG和SARIF: Codex Security拥有最成熟的管线工具，如果你的Org可以访问的话。
Cloudflare的技能在agent上运行
- 有一支安全小组和一个沙盒：螳螂提供最深的证明循环，进行复制和对抗补丁测试。
Cloudflare自己的建筑提出了实用的组合。 用一个工具或模型运行发现，然后用另一个工具或模型验证。 不同的模型会表面显示被虫的不同份额。
米哈尔·萨特(Michal Sutter)是一名数据科学专业人员，拥有帕多瓦大学的数据科学硕士。 在统计分析、机器学习和数据工程的坚实基础上，Michal出色地将复杂的数据集转化为可操作的见解。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic, OpenAI, Cloudflare and Google now each ship an AI agent that hunts security bugs in source code. We checked the repos, docs and technical details behind each one.
The key finding: all 4 tools converge on one design. One agent finds a bug, a separate agent tries to disprove it, and only survivors get a patch. The differences are in where they run, who can use them and how much proof they demand.
Key Takeaways
- 4 labs, 1 pattern: find, independently disprove, then patch.
- Claude Security runs inside Claude Code; no extra API key needed.
- Codex Security’s CLI is Apache-2.0, but scanning still needs OpenAI access.
- Cloudflare’s skill is MIT, model-agnostic and the most-starred at 47.5K.
- Google’s Mantis reproduces bugs in a sandbox; Google says isolate it.
Why 4 labs shipped the same thing in 2026
The problem every one of them is solving is noise. Google’s security team writes that sloppy AI code scanning produces hallucinated bugs and true-positive rates under 7%. A scanner that is wrong 93% of the time costs reviewers more than it saves.
The shared fix is separation of duties. The agent that reports a finding never gets to confirm it. Cloudflare states the rule directly in its README: the verifier is never the agent that found the bug. Anthropic, OpenAI and Google each describe a similar validation step before anything reaches a report.
The second driver is offense. Anthropic team states that it built its scanner partly because attackers were already using AI models to find exploitable flaws, per The Hacker News. Google opens its Mantis post by noting that models can now discover and exploit bugs with little human help.
1. Claude Security by Anthropic
What it is: A multi-agent vulnerability scanner that runs inside a Claude Code session. It is the local version of Anthropic’s hosted Claude Security product, per the plugin README.
How it works: Agents map the architecture, build a threat model, hunt across every component and verify each finding independently. The plugin offers 3 jobs from one menu: scan the codebase, scan changes, or suggest patches, per Claude Code docs.
Output: A Markdown report along with a SARIF 2.1.0 file for GitHub code scanning. Each finding carries severity, a CWE category, impact and reproduction steps. Patches are drafted in a scratch copy and land as F<n>.patch files. The plugin never commits, pushes or opens a pull request on its own.
Cost and access: It makes no model calls of its own, so there is no separate API key. Scans count against your Claude plan’s usage limits.
/plugin install claude-security@claude-plugins-official
/claude-security
Timeline: Anthropic opened a limited preview called Claude Code Security in February 2026. The hosted product reached public beta for Enterprise customers on Claude Opus 4.7. The Claude Code plugin entered beta on July 22, 2026, per Cybersecurity News. In August, the hosted scanner moved to Claude Mythos 5, per Dataconomy.
Where it fits: Anthropic positions it as one layer. The security-guidance plugin checks code as Claude writes it, and /security-review does a single pass on a branch. Claude Security is the on-demand deep scan.
2. Codex Security by OpenAI
What it is: A CLI and TypeScript SDK, published as @openai/codex-security, for finding, validating and fixing vulnerabilities.
How it works: It scans a whole repo, selected paths, or a Git diff. A –mode deep flag runs parallel discovery workers. It validates candidate findings, generates patches and can verify existing fixes. A cs policy command drafts a SECURITY.md that tells future scans what counts as a vulnerability in your project.
Output: Threat models, SARIF, JSON or CSV exports, plus publishing to Linear. It can import GitHub code-scanning alerts and suggest owners from Git history. A GitHub Action runs scheduled or pull-request scans; findings are report-only by default.
npm install --global @openai/codex-security
cs login
cs scan Cost and access: The client is Apache-2.0, but the scanner behind it is not. DevOps.com notes the CLI and SDK stay in limited beta for approved customers. The README lists OpenAI, Amazon Bedrock, OpenRouter and Fireworks AI as providers. Requires Node.js 22.13+ and Python 3.10+.
3. Security Audit Skill by Cloudflare
What it is: An MIT-licensed skill that turns any capable coding agent into a security auditor.
How it works: A 6-phase audit:
- Reconnaissance: map architecture, trust boundaries and input surfaces into architecture.md and a coverage ledger.
- Coverage-led hunting: isolated hunters each take ledger units; coverage critics look for gaps.
- Candidate validation: a fresh verifier tries to disprove every unique candidate.
- Structured output: confirmed, needs_validation and rejected records go to findings.json, checked against a schema.
- Independent record verification: new agents re-verify every final source claim.
- Target-neutral reporting: REPORT.md and detail files are derived from the verified records.
Requirements: A coding agent that supports tool use and parallel sub-agents, plus Node.js for the validators. It also wants an OS-enforced sandbox with no external network. Without one, leads stay needs_validation instead of being executed.
npx skills add https://github.com/cloudflare/security-audit-skill –skill security-audit
Then ask the agent: “security audit this codebase.” Output defaults to ~/security-audit-skill/<repo-name>/run-<N>, outside your repo.
The data behind it: Cloudflare published the skill on June 18, 2026, with its post Build your own vulnerability harness. The roughly 450-line skill seeded an internal harness that now scans 128 repos. Cloudflare reports these lifetime numbers:
- 20,799 raw candidates from discovery, about 12,057 of which survived validation.
- 13,841 findings in the shared triage pool across 145 repos, including another harness’s output.
- 5,442 folded away as duplicates and 1,154 routed out as wrong-repo or low-risk.
- 7,245 actionable findings sent to engineering teams.
Better recon context cut the first-pass rejection rate from 40% to 11%. Cloudflare also uses one model for discovery and a different model for triage, so models check each other.
4. Mantis by Google
What it is: An Apache-2.0 set of security-review skills plus an ADK reference harness for AI coding agents. Google team states that it is part of how it finds and fixes bugs internally.
How it works: Mantis reads the repo’s history to learn from past security fixes. It builds a hierarchical summary tree, condensing files into directory and root summaries. Google team states that this cut token overhead by over 85%. It then generates a threat model and hypotheses, hunts, deduplicates and critiques findings.
What sets it apart: Reproduction and patch verification. Mantis tries to reproduce each bug, from a static exploit sketch up to a unit test or mock server. It patches with an adversarial loop that attacks the fix. It also calibrates severity against a rubric to stop “thousands of criticals.” A mantis-advise skill then feeds what it learned back into code generation.
Setup: Clone the repo and point any coding agent at it, or run the ADK harness directly. The harness supports a –focus prompt such as “look for IDOR” and a –max-tokens spend ceiling.
git clone https://github.com/google/mantis.git
cd mantis/reference && ./install.sh
./run.sh path/to/code
Side-by-side
Beyond the big 4: other AI bug hunters launched in 2026
At least 12 more agent-based vulnerability tools shipped or went public in 2026. Almost all repeat the same find-then-independently-verify loop. They split into free harnesses you run yourself and commercial or internal platforms.
Open-source harnesses
AppSec Santa also tracks harnesses from Anthropic (defending-code-reference-harness), Trail of Bits, Capital One (vulnhunter) and Cisco (ai-deep-sast). Cisco’s runs fully local on Foundation-Sec-8B, so no code leaves the machine.
Commercial platforms and internal systems
The pattern holds across vendors: deterministic engines or validators do the proving, models do the reasoning, and a human approves every fix.
Which one to run first
- Already on Claude Code: start with the Claude Security plugin. It installs in 1 line and uses your existing plan.
- Need CI gating and SARIF in GitHub: Codex Security has the most mature pipeline tooling, if your org has access.
- Want no vendor lock-in: Cloudflare’s skill runs on any agent with parallel sub-agents and is fully MIT.
- Have a security team and a sandbox: Mantis gives the deepest proof loop, with reproduction and adversarial patch testing.
Cloudflare’s own architecture suggests a practical combination. Run discovery with one tool or model, then validate with a different one. Different models surface different shares of the bugs.
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.