Four labs' code-security agents share a find-then-disprove design
Original title: AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare
Claude Security, Codex Security, Cloudflare's skill and Google Mantis differ in runtime, access and how much proof they require.
A comparison of published repos and docs finds that Anthropic, OpenAI, Cloudflare and Google each ship a source-code security agent built around the same pattern: one agent finds a bug, a separate agent tries to disprove it, and only survivors are patched. Claude Security runs inside Claude Code with no extra API key. Codex Security's CLI is Apache-2.0, but scanning still needs approved OpenAI access and remains in limited beta. Cloudflare's MIT-licensed skill is model-agnostic; Google's Mantis reproduces bugs in a sandbox that Google says should be isolated.
Unconfirmed: The piece compares vendor documentation rather than reporting an independent head-to-head benchmark.
- Google's team cites hallucinated bugs and true-positive rates under 7% as the noise problem.
- Claude Security outputs Markdown and SARIF 2.1.0 and does not commit, push or open pull requests itself.
- Codex Security requires Node.js 22.13+ and Python 3.10+; findings from its GitHub Action are report-only by default.
- Cloudflare's skill is the most-starred of the four at 47.5K stars.
- AI models
- Claude Opus 4.7Claude Mythos 5
From the original article
12 min read at marktechpost.comAnthropic, OpenAI, Cloudflare and Google each released an AI agent that hunts security bugs in source code. All 4 use the same find, disprove, then patch loop. Here is how they differ, plus 12 more tools.
By Michal Sutter · marktechpost.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.