@rohanpaul_ai: AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the…
Summary
研究发现安全漏洞挖掘AI代理60.4%的token用于理解代码与推理触发方式，并提出AVRI工具复用代码关系知识，在Codex和OpenCode上分别降低18.0%和23.7%成本且不损失成功率。
View Cached Full Text
Cached at: 10/19/26, 11:22 AM
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.
Similar Articles
@vintcessun: Agent security can now go beyond monitoring tool calls and even read its reasoning process in real time. Before an agent executes an action, Adrian checks both the behavior logs and the reasoning chain, cross-referencing between the two dimensions. The result? A DeepMind paper shows that joint analysis improves accuracy by 35% over behavior-only checks. It…
Adrian is an open-source AI agent runtime security monitoring engine that detects anomalies by jointly analyzing the agent’s behavior logs and reasoning chain, improving accuracy by 35% over behavior-only checks. It supports LangChain integration with a two-line SDK.
@XAMTO_AI: A two-person security team used AI to find real vulnerabilities in code and earned $250,000 from a single bounty. Now they've open-sourced the system as Open-Kritt. It's not a toy that throws a repo at an AI to search blindly; it's an orchestration platform that turns AI agents into a small security team. Most people just hand an AI a…
Open-Kritt is an open-source security research platform that orchestrates multiple AI agents to analyze code in parallel, automating discovery of real vulnerabilities, and supports deduplication, validation, and prioritization. The team behind it has used it to earn significant bounties and win the Firedancer audit contest.
Block on Finding and Fixing Security Risks with OpenAI
Block shared how it uses OpenAI’s AI capabilities to discover and fix software security risks—the tool goes beyond statically scanning code to reason about attack patterns, cross trust boundaries, and chain together multistep attacks, revealing complete, end-to-end compromise paths while helping pinpoint issues, identify owners, suggest patches, and verify that fixes are effective.
@Xudong07452910: This paper is a must-read for heavy users of Claude Code, Codex, or other AI Agents. It doesn't study how Agents fail on benchmarks, but a more real problem: In real development, what exactly are AI coding agents doing...
This paper analyzes 20,574 real-world coding-agent sessions to identify how AI agents misalign with developer intent, finding that constraint violations and inaccurate self-reporting are the most common failure modes, imposing trust and effort costs rather than irreversible damage.
I tested AI agents on fixing real security bugs. Here's what I found.
Independent research benchmarked AI agents on fixing 20 real vulnerabilities from Python projects; best solve rate was 50%, expensive models not worth it, and dangerous false positives where agents produced convincing but incomplete fixes.