Anthropic, OpenAI, Google, and Cloudflare have each released AI security agents designed to hunt bugs in source code. All four tools converge on a single design pattern where one agent finds a bug, an independent agent attempts to disprove it, and only the surviving findings receive a patch. This multi-agent verification approach addresses the problem of high false-positive rates that previously rendered sloppy AI code scanners impractical for engineering teams.
The four implementations differ primarily in their deployment environments, licensing, and verification workflows. Anthropic integrates its security agent directly into Claude Code for local execution without requiring a separate API key. OpenAI provides a CLI and TypeScript SDK under an Apache-2.0 license, though its backend scanning requires OpenAI access. Google utilizes its Mantis sandbox environment to isolate and reproduce bugs, while Cloudflare offers a model-agnostic, open-source skill that has gained widespread adoption.
These systems were developed in response to the growing use of AI models by attackers to discover and exploit vulnerabilities autonomously. By separating the duties of finding and confirming flaws, these tools aim to reduce hallucinated reports and provide reliable remediation steps for developers. This shared architectural shift marks a major maturation in automated application security.