Anthropic, OpenAI, Cloudflare and Google ship AI security scanners that work the same way

How it works

AI programs that scan computer code to find security bugs

Maps the code and lists where attackers could enter
Searches the whole codebase for vulnerabilities
A different agent checks each finding separately
Writes fix patches without committing anything

What you could do with it

A developer using Claude Code could scan an entire repository for security vulnerabilities and receive a report listing each finding's severity, CWE category, impact, and steps to reproduce it ².
A security team could run Cloudflare's MIT-licensed security audit skill against any capable coding agent to produce a six-phase audit covering architecture mapping, threat modeling, vulnerability hunting, and independent verification of every finding ¹.
An engineering organization could publish an OpenAI Codex Security scan on GitHub Actions to automatically check scheduled or pull-request changes and report findings as SARIF reports without committing anything on its own ¹.

One pattern, four labs

Google's security researchers found that careless AI code scanning creates false bugs and achieves true-positive rates below 7 percent ¹. A scanner that is wrong 93 percent of the time costs reviewers more than it saves .

The common solution is a separation of responsibilities. The agent that identifies an issue is never allowed to verify it ¹. Cloudflare makes this rule explicit in its README: the person validating a finding is never the same agent that discovered the bug . Anthropic, OpenAI, and Google all describe a similar verification step before any issue reaches a report .

The second driver is offense. Anthropic says it built its scanner in part because attackers were already using AI models to locate exploitable vulnerabilities ¹. Google's Mantis post opens by pointing out that models can now find and exploit bugs with very little human assistance .

Claude Security by Anthropic

Claude Security runs inside a Claude Code session as a multi-agent vulnerability scanner ¹. It maps the architecture, builds a threat model, hunts across every component and verifies each finding independently ². The plugin offers three jobs: scan the codebase, scan changes, or suggest patches .

Output includes a Markdown report and a SARIF 2.1.0 file for GitHub code scanning ¹. Each finding carries severity, a CWE category, impact and reproduction steps . Patches are drafted in a scratch copy and land as F<n>.patch files . The plugin never independently commits, pushes, or opens a pull request .

It does not make any model calls on its own, which means there is no separate API key needed ¹. Scans count against your Claude plan's usage limits ². Anthropic launched a restricted preview named Claude Code Security in February 2026 . The hosted version reached public beta for Enterprise customers through Claude Opus 4.7 . The Claude Code plugin entered beta on July 22, 2026 . In August, the hosted scanner moved to Claude Mythos 5 .

Codex Security by OpenAI

Codex Security is a CLI and TypeScript SDK published as @openai/codex-security ¹. It scans a whole repo, selected paths, or a Git diff . A --mode deep flag runs parallel discovery workers . It validates candidate findings, generates patches and can verify existing fixes .

Output includes threat models, SARIF, JSON or CSV exports, plus publishing to Linear ¹. A GitHub Action executes scheduled or pull-request-based scans; any discoveries are treated as report-only by default . The client is Apache-2.0 licensed, but the scanner behind it is not . DevOps.com reports that the CLI and SDK remain in limited beta for approved customers .

Security Audit Skill by Cloudflare

Cloudflare's MIT-licensed skill turns any capable coding agent into a security auditor ¹. It runs a six-phase audit: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and target-neutral reporting .

The prerequisites include a coding agent that handles tool use and parallel sub-agents, plus Node.js for the validation layer ¹. It also wants an OS-enforced sandbox with no external network . Without one, leads stay needs_validation instead of being executed . Cloudflare published the skill on June 18, 2026 . The approximately 450-line capability served as the starting point for an internal testing harness that now scans 128 repositories .

Google's Mantis

Google's Mantis reproduces bugs in a sandbox ¹. Google says to isolate it . The tool follows the same find-disprove-patch pattern as the others .

How good is it

Google's security researchers found that careless AI code scanning produced true-positive rates below 7 percent, meaning roughly 93 percent of flagged bugs were false alarms and cost reviewers more than they saved ¹. Cloudflare reported that improving recon context cut its first-pass rejection rate from 40 percent down to 11 percent in its internal harness scanning 128 repositories . Google said Mantis's hierarchical summary tree cut token overhead by over 85 percent while building threat models . None of the tools posted external benchmark scores against rival scanners in the sources provided .