AI Agents for Vulnerability Discovery: Claude, Codex, Mantis and Cloudflare

On October 30, 2026, MarkTechPost published a comparison of AI agents for code security from Anthropic, OpenAI, Cloudflare and Google. All four tools look for vulnerabilities in source code, verify findings and suggest patches. The key similarity: one agent finds a bug, another tries to refute it, and only confirmed bugs receive a fix.

Previously, code scanners often made mistakes. Google notes in its blog: a careless AI scan produces hallucinated bugs, and the share of true positives is below 7%. Such a tool creates more work than it saves. The new approach separates responsibilities: the agent that reported a finding cannot confirm it. Cloudflare states directly in the README: the verifier is not the one who found it. This differs from previous generations of scanners, where a single tool both searched and confirmed, which increased the risk of false positives.

In practice, the differences lie in where the agents run, who has access to them, and how much evidence they require. Claude Security runs inside Claude Code and does not require a separate API key. Codex Security has a CLI under the Apache-2.0 license, but scanning requires access to OpenAI. Cloudflare offers a skill under the MIT license, not tied to a specific model; it has 47.5 thousand stars on GitHub. Google Mantis reproduces bugs in a sandbox and, according to Google, requires isolation. All four tools appeared in 2026, and their similarity points to a common vector: combating noise in scan results.

What remains unknown: MarkTechPost does not provide comparative metrics for the accuracy or speed of these agents. There is also no data on how the tools behave on real projects beyond demonstrations.