Four Labs, One Blueprint: How AI Security Agents Converged in 2026

All four major AI labs — Anthropic, OpenAI, Cloudflare and Google — now ship an AI agent that hunts security bugs in source code, and every one of them converged on the same core design: one agent finds a bug, a separate agent tries to disprove it, and only survivors get a patch.

That's the key finding of a comparison of the repos, docs and technical details behind each tool. The differences between them come down to where they run, who can use them, and how much proof they demand before reporting a finding.

The stakes are straightforward. Google's security team writes that sloppy AI code scanning produces hallucinated bugs and true-positive rates under 7%. A scanner that is wrong 93% of the time costs reviewers more than it saves. The vendors' answer — separation of duties, where the agent that reports a finding never gets to confirm it — is now the industry baseline.

Cloudflare states the rule directly in its README: the verifier is never the agent that found the bug. Anthropic, OpenAI and Google each describe a similar validation step before anything reaches a report.

There's an offensive driver too. Anthropic's team says it built its scanner partly because attackers were already using AI models to find exploitable flaws, per The Hacker News. Google opens its Mantis announcement by noting that models can now discover and exploit bugs with little human help.

What does each tool actually do?

Claude Security by Anthropic

Claude Security is a multi-agent vulnerability scanner that runs inside a Claude Code session. It's the local version of Anthropic's hosted Claude Security product, per the plugin README.

Agents map the architecture, build a threat model, hunt across every component, and verify each finding independently. The plugin offers three jobs from one menu: scan the codebase, scan changes, or suggest patches, per the Claude Code docs.

Output is a Markdown report plus a SARIF 2.1.0 file for GitHub code scanning. Each finding carries severity, a CWE category, impact, and reproduction steps. Patches land as F

Because the plugin makes no model calls of its own, there's no separate API key. Scans count against your Claude plan's usage limits. Installation is one line: /plugin install claude-security@claude-plugins-official.

The timeline: Anthropic opened a limited preview called Claude Code Security in February 2026. The hosted product reached public beta for Enterprise customers on Claude Opus 4.7. The Claude Code plugin entered beta on July 22, 2026, per Cybersecurity News. In August, the hosted scanner moved to Claude Mythos 5, per Dataconomy.

Anthropic positions the tool as one layer among several. A security-guidance plugin checks code as Claude writes it, and /security-review does a single pass on a branch. Claude Security is the on-demand deep scan.

Codex Security by OpenAI

Codex Security is a CLI and TypeScript SDK, published as @openai/codex-security, for finding, validating, and fixing vulnerabilities.

It scans a whole repo, selected paths, or a Git diff. A --mode deep flag runs parallel discovery workers. It validates candidate findings, generates patches, and can verify existing fixes. A cs policy command drafts a SECURITY.md that tells future scans what counts as a vulnerability in your project.

Output options include threat models, SARIF, JSON or CSV exports, and publishing to Linear. It can import GitHub code-scanning alerts and suggest owners from Git history. A GitHub Action runs scheduled or pull-request scans, with findings report-only by default.

Here's the catch on access: the client is Apache-2.0, but the scanner behind it is not. DevOps.com notes the CLI and SDK stay in limited beta for approved customers. The README lists OpenAI, Amazon Bedrock, OpenRouter, and Fireworks AI as providers. You'll need Node.js 22.13+ and Python 3.10+.

Installation: npm install --global @openai/codex-security, then cs login and cs scan.

Security Audit Skill by Cloudflare

Cloudflare's entry is an MIT-licensed skill that turns any capable coding agent into a security auditor. It's also the most popular of the four, at 47.5K stars.

The skill runs a 6-phase audit:

1. Reconnaissance: map architecture, trust boundaries, and input surfaces into architecture.md and a coverage ledger.
2. Coverage-led hunting: isolated hunters each take ledger units; coverage critics look for gaps.
3. Candidate validation: a fresh verifier tries to disprove every unique candidate.
4. Structured output: confirmed, needs_validation, and rejected records go to findings.json, checked against a schema.
5. Independent record verification: new agents re-verify every final source claim.
6. Target-neutral reporting: REPORT.md and detail files derive from the verified records.

Requirements are a coding agent that supports tool use and parallel sub-agents, plus Node.js for the validators. It also wants an OS-enforced sandbox with no external network. Without one, leads stay in needs_validation instead of being executed.

Install with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, then ask the agent: "security audit this codebase." Output defaults to ~/security-audit-skill/

The production data behind it is unusually detailed. Cloudflare published the skill on June 18, 2026, alongside a post titled "Build your own vulnerability harness." The roughly 450-line skill seeded an internal harness that now scans 128 repos. Cloudflare's lifetime numbers:

• 20,799 raw candidates from discovery, about 12,057 of which survived validation.
• 13,841 findings in the shared triage pool across 145 repos, including another harness's output.
• 5,442 folded away as duplicates and 1,154 routed out as wrong-repo or low-risk.
• 7,245 actionable findings sent to engineering teams.

Better recon context cut the first-pass rejection rate from 40% to 11%. Cloudflare also uses one model for discovery and a different model for triage, so models check each other.

Mantis by Google

Mantis is an Apache-2.0 set of security-review skills plus an ADK reference harness for AI coding agents. Google's team says it's part of how the company finds and fixes bugs internally.

Mantis reads the repo's history to learn from past security fixes. It builds a hierarchical summary tree, condensing files into directory and root summaries — a step Google says cut token overhead by over 85%. It then generates a threat model and hypotheses, hunts, deduplicates, and critiques findings.

What sets Mantis apart is reproduction and patch verification. It tries to reproduce each bug, from a static exploit sketch up to a unit test or mock server. It patches with an adversarial loop that attacks the fix. It also calibrates severity against a rubric to stop "thousands of criticals." A mantis-advise skill feeds what it learned back into code generation.

Setup means cloning the repo and pointing any coding agent at it, or running the ADK harness directly. The harness supports a --focus prompt such as "look for IDOR" and a --max-tokens spend ceiling. Google's advice on isolation is blunt: run it sandboxed.

How do the four compare side by side?

The comparison splits along license, model lock-in, and proof depth:

• Cloudflare Security Audit Skill: MIT license, runs on any coding agent with parallel sub-agents, no model lock-in. A fresh agent disproves candidates, then a second independent verification pass. No patches.
• Codex Security (OpenAI): Apache-2.0 client with a hosted scanner behind it. Runs via CLI, SDK, or GitHub Action. OpenAI-gated, though Bedrock, OpenRouter, and Fireworks are supported. Validates candidates and verifies fixes. Produces patches.
• Mantis (Google): Apache-2.0, runs on any coding agent or the ADK harness in an isolated environment, no lock-in. Sandboxed reproduction plus an adversarial patch loop. Produces patches.
• Claude Security (Anthropic): Plugin in Anthropic's official marketplace, runs in a Claude Code session, tied to Claude models. Independent verifier panel. Produces patches as .patch files.

What else launched in 2026?

The big four are not alone. At least 12 more agent-based vulnerability tools shipped or went public in 2026, and almost all repeat the same find-then-independently-verify loop.

Open-source harnesses include:

• Visa Vulnerability Agentic Harness (VVAH): released June 10, 2026, after Visa tested Claude Mythos Preview via Project Glasswing. A 4-phase, 11-stage pipeline with policy gates and human review; works with Claude or OpenAI-compatible models. Remediation and fix validation were added later.
• OpenHack (Hadrian): MIT-licensed, released May 25, 2026. Runs inside Claude Code, Codex, or Cursor with all state in plain files. Expert agents prove or reject scenarios; an independent triage agent picks final findings.
• deepsec (Vercel Labs): MIT-licensed, released May 4, 2026. A regex prefilter picks security-sensitive files, agents investigate, and a second pass revalidates. Vercel fans scans out to 1,000+ concurrent sandboxes.

AppSec Santa also tracks harnesses from Anthropic (defending-code-reference-harness), Trail of Bits, Capital One (vulnhunter), and Cisco (ai-deep-sast). Cisco's runs fully local on Foundation-Sec-8B, so no code leaves the machine.

What about the commercial platforms?

The commercial and internal systems push the same pattern at larger scale:

• Signal Agentic Fix (Black Duck), launched Oct 28, 2026: scan, triage, fix, validate, submit. Works alongside coding agents such as Claude Code; every change goes to a human.
• Continuum for code vulnerabilities (AWS), GA Oct 22, 2026 after a June 17 preview: checks exploitability against your actual AWS setup and opens fix pull requests. It absorbed the former AWS Security Agent, and every fix needs human approval.
• Evo Agentic AppSec (Snyk), preview from Oct 15, 2026: agents drive Snyk's deterministic engines as tools. Snyk's own VulnBench found 49.7% of LLM-only review findings vanish on the next run.
• PageBreak (Google Product Security), disclosed Sep 24, 2026, internal only: 500+ verified XSS bugs in Google's own web apps. Separate, non-AI validators fire each exploit at a running app before anyone sees it.
• Agentic Workflows (Semgrep), public beta from Jul 28, 2026: 9 prebuilt workflows covering 70+ CWEs, pairing deterministic taint analysis with frontier models such as Claude Opus.
• Patch the Planet (OpenAI + Trail of Bits), program since Jun 22, 2026: engineers using Codex Security and GPT-5.5-Cyber across 19 open-source projects. First week: 64 PRs and 51 issues.
• MDASH (Microsoft), expanded preview from May 12, 2026: 100+ agents on an ensemble of models. It found 16 new Windows bugs, 4 of them critical RCEs.
• Red Agent (Wiz), GA after an April 22 preview at RSA 2026: attacks live APIs and apps from outside rather than reading source. Runs on Claude Opus among other models.
• Xint Code (Theori), commercial, disclosed Apr 29, 2026: found "Copy Fail" (CVE-2026-31431), a 9-year-old Linux root bug, in about 1 hour of scanning. CISA added it to its exploited-vulnerabilities list.

The pattern holds across every vendor: deterministic engines or validators do the proving, models do the reasoning, and a human approves every fix.

Which one should you run first?

The comparison ends with a practical routing guide:

• Already on Claude Code: start with the Claude Security plugin. It installs in one line and uses your existing plan.
• Need CI gating and SARIF in GitHub: Codex Security has the most mature pipeline tooling, if your organization has access.
• Want no vendor lock-in: Cloudflare's skill runs on any agent with parallel sub-agents and is fully MIT.
• Have a security team and a sandbox: Mantis gives the deepest proof loop, with reproduction and adversarial patch testing.

Cloudflare's own architecture suggests a practical combination: run discovery with one tool or model, then validate with a different one. Different models surface different shares of the bugs — and in a field where a 7% true-positive rate is the failure mode everyone is escaping, that cross-checking is the whole point.