Anthropic, OpenAI, Google, Cloudflare debut AI agents for code security

What are AI security agents and why they matter?

AI security agents are specialized large‑language‑model (LLM) tools that automatically scan source code, identify potential vulnerabilities, attempt to confirm whether the findings are true positives, and then suggest or generate a fix. According to MarkTechPost, the four newest agents from Anthropic, OpenAI, Google and Cloudflare follow this "find‑disprove‑patch" loop. By handling the three most time‑consuming steps of a typical security review, these agents can reduce manual effort, accelerate release cycles, and lower the risk of exploitable bugs slipping into production.

Which companies have launched agents and what are they called?

The article lists four vendors that have introduced dedicated security‑focused agents:

• Anthropic – an agent dubbed Claude.
• OpenAI – an agent built on the Codex model.
• Google – an agent named Mantis.
• Cloudflare – an unnamed agent released under the Cloudflare brand.

Each of these offerings is positioned as a plug‑in or SaaS service that developers can invoke directly from their development environment or CI pipeline. The announcement marks a convergence of AI‑driven code analysis with traditional static‑application‑security‑testing (SAST) tools.

How do the agents operate – the find‑disprove‑patch loop?

All four agents share the same high‑level workflow, as described by MarkTechPost:

1. Find – The LLM reads the submitted source files and generates a list of statements that might be security issues, such as unsafe input handling, hard‑coded secrets, or misconfigured permissions.
2. Disprove – For each candidate, the agent runs a quick reasoning step, often backed by a small test harness or static analysis, to decide whether the finding is a true vulnerability or a false alarm.
3. Patch – When a genuine issue is confirmed, the model proposes a code change that resolves the problem, typically returning a diff that can be reviewed and applied.

The loop is designed to be iterative: after a patch is accepted, the agent can re‑run the scan to ensure the fix did not introduce new concerns.

Where do the agents differ?

MarkTechPost notes that, while the underlying loop is identical, the four agents differ in implementation details. Specific distinctions include the underlying model family (Claude vs. Codex vs. Mantis vs. Cloudflare's internal model), integration points (IDE plug‑ins, CLI tools, or web dashboards), and pricing structures. The article also points out that each vendor brings its own ecosystem expertise—Anthropic’s focus on safety‑aligned prompting, OpenAI’s extensive Codex training on public code, Google’s massive internal codebase, and Cloudflare’s edge‑focused security posture. Because the post does not list exact performance numbers, readers are encouraged to run side‑by‑side trials to see which agent aligns best with their codebase and workflow.

How can developers test or compare the agents today?

Developers interested in a hands‑on comparison can start by signing up for the preview programs offered by each vendor. Most agents expose a simple API endpoint that accepts a repository URL or a zip file and returns a JSON report of findings and suggested patches. A practical approach is to:

1. Select a representative code sample – a small open‑source project that contains known vulnerabilities.
2. Invoke each agent – using the vendor‑provided CLI or HTTP request.
3. Collect the output – capture the list of findings, false‑positive rate, and patch quality.
4. Measure latency and cost – note how long each call takes and the associated token or usage fees.

Grafy users can streamline this workflow with the Grafy Code studio, which lets you run shell commands, install dependencies, and view API responses in a single notebook‑style interface. By piping the JSON results into a Grafy Graph, you can visually branch the different agents' outputs, compare patch diffs side‑by‑side, and annotate which findings were confirmed manually. For quick language‑model experiments, the Grafy Chat interface lets you load Claude, Codex, or other models side by side and ask them to explain a particular vulnerability, giving a low‑overhead sanity check before invoking the full agents.

Grafy perspective – using Grafy tools to explore AI security agents

While Grafy does not host the four security agents directly, its multimodal workspace makes it easy to evaluate them without leaving the platform. Here’s a concrete recipe for a Grafy‑centric test:

1. Create a new project in Grafy Code and upload the target repository.
2. Add four code cells, each containing a curl or Python request to the respective vendor’s endpoint (Claude, Codex, Mantis, Cloudflare).
3. Run the cells to collect the JSON reports.
4. Open a Graph view and drag the four JSON nodes onto the canvas. Use the built‑in diff visualizer to compare the patches each agent proposes.
5. Ask Grafy Chat to summarize the differences: "What are the main reasons Claude flagged X while Codex did not?" Because Chat can query multiple models, you can get a meta‑analysis from a neutral perspective.

If you need to read the official documentation PDFs that accompany each agent, the Grafy Reader can ingest those files, let you search for specific sections, and answer questions like “What is the token pricing for Mantis?” without leaving the workspace. This end‑to‑end approach lets developers make an evidence‑based decision about which AI security agent fits their stack.

Frequently asked questions

How does the "find‑disprove‑patch" loop differ from traditional static analysis?

Traditional static analysis flags potential issues based on rule sets and often requires a human to verify each warning. The AI loop adds a reasoning step (disprove) that automatically validates the warning, and a generation step (patch) that suggests concrete code changes, reducing manual triage.

Are the four agents interchangeable for any programming language?

The article does not specify language coverage, but each vendor’s model is trained on large code corpora. In practice, support may vary—Claude and Codex are known for strong Python and JavaScript performance, while Google’s Mantis may excel on languages common in its internal codebase. Testing on your target language is recommended.

Can I use Grafy to run the agents without paying for each vendor’s service?

Grafy provides the environment to orchestrate calls to the agents, but the underlying APIs are billed by the respective vendors. Grafy itself does not waive those costs; you’ll need active subscriptions or trial credits from Anthropic, OpenAI, Google and Cloudflare.

---

Source: MarkTechPost — AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare