[ { "slug": "zkao", "name": "zkao", "tagline": "AI bug detection for cryptography code, run continuously", "title": "zkao (zkSecurity): AI bug detection for cryptography code and ZK circuits, results, pricing and how it works", "maintainer": "zkSecurity", "url": "https://zkao.io", "category": "crypto-zk", "targets": [ "Circom", "Leo (Aleo)", "Rust crypto", "Go crypto", "MPC", "FHE", "Post-quantum", "TLS / E2EE" ], "approach": "Multi-agent LLM workflows with expert-maintained skills, a second wave of validating agents, PoC harnesses, and automatic re-scans as models improve", "license": "SaaS; prepaid non-expiring credits; enterprise plans with human audits", "status": "Active (zkao 2.0 released 2026-07-24)", "since": "2026-02-07", "summary": "zkao is zkSecurity's AI-powered continuous security scanner for cryptography code: ZK circuits, MPC protocols, FHE schemes, end-to-end encryption, TLS stacks and post-quantum primitives. It connects to a GitHub repository, runs multi-agent analysis built from zkSecurity's audit patterns, validates findings with a second wave of agents and re-runs scans as models improve. Its public results in 2026 include seven confirmed bugs in Cloudflare's CIRCL library, the critical OpenVM zkVM soundness bug CVE-2026-46669, and four zero-days in Bron Labs' bron-crypto, all fixed upstream.", "details": [ "The pipeline has five stages: connect a repository, parse the code, multi-agent deep analysis, validate findings to filter false positives, and report. A first pass of agents reviews the codebase and reports findings, then a second wave reviews those findings; the loop runs repeatedly as 'zkao workflows'. Named flows such as `cryptopsy` combine implementation analysis with cross-referencing academic literature, and subagents are designed to output knowledge about a module (assumptions, invariants) rather than bug lists. Expert-maintained skills encode patterns from more than a hundred zkSecurity audits. A user-supplied `zkao.md` threat model file reduces noise: on the HumanityLink engagement it cut false positives from 14 of 33 findings to 2.", "The product thesis is that LLM bug finding is non-deterministic, so coverage compounds with repeated runs, and that the harness around the model matters more than raw repetition. Findings are deduplicated across runs and scans re-trigger when models or patterns change. For Aleo, a Rust cheatcode harness called cheatVM turns findings into executable end-to-end proofs of concept. Underlying models are not disclosed on the product pages; case studies mention Claude Opus 4.6 and 4.8, GPT-5.3 and 5.5, and Codex.", "Launched in February 2026 with Circom as the first target, zkao added Leo support in July 2026 and zkao 2.0 (24 July 2026) replaced subscriptions with prepaid, non-expiring credits capped per scan. The pricing page lists three tiers by codebase size with median costs of about 49, 281 and 1,112 dollars per scan; project creation is free and sign-in is curated. Enterprise continuous coverage backed by zkSecurity engineers and manual audits is available. Solidity and EVM code are not the focus.", "Published results are the reason it leads this category. Cloudflare CIRCL (July 2026): seven confirmed bugs, six awarded under Cloudflare's HackerOne program, including a critical CP-ABE access-control break and a rogue-key BLS aggregate-signature flaw the AI had rated medium. OpenVM (July 2026): a missing subfield membership check on a prover-supplied scaling factor in the pairing guest library that let a malicious prover forge any pairing equality; plain Opus 4.6 and Codex 5.3 runs found only low-severity issues, and zkao found it after more than nine hours of scanning. Bron Labs (July 2026): four zero-days found by a dual-agent auditor and validator pipeline. zkSecurity's own caveat, quoted in the CIRCL post: the AI produced candidate findings, not final reports, and humans validated each issue." ], "strengths": [ "Only AI tool with public, upstream-confirmed critical findings in cryptographic libraries and a zkVM.", "Built and validated by a cryptography audit firm; skills encode real audit patterns and a threat-model file measurably reduces false positives.", "Continuous model: prepaid credits, deduplicated re-scans, and an enterprise path to human audits from the same team." ], "limits": [ "Candidates, not reports: zkSecurity's own posts document mis-rated severities and triage of more than a thousand candidates as the main bottleneck.", "Language coverage is cryptography-first (Circom, Leo, Rust, Go); Solidity and EVM are out of scope.", "Curated sign-in and no free tier; underlying models are not disclosed on the product pages." ], "fit": [ "Choose zkao when your codebase is cryptographic (circuits, proof-system libraries, MPC, post-quantum, TLS) and you want continuous AI coverage from a team that can also do the human validation. Start with the single-circuit tier on a component with a written threat model, and read the CIRCL and OpenVM posts to calibrate expectations. The maintainer, [zkSecurity](/firms/zksecurity/), is listed first on this index." ], "references": [ [ "zkao", "https://zkao.io" ], [ "How it works", "https://zkao.io/how-it-works" ], [ "Continuous security", "https://zkao.io/continuous-security" ], [ "Pricing", "https://zkao.io/pricing" ], [ "Launch post (2026-02-07)", "https://blog.zksecurity.xyz/posts/zkao-launch/" ], [ "zkao 2.0 (2026-07-24)", "https://blog.zksecurity.xyz/posts/zkao-2-0/" ], [ "Seven bugs in Cloudflare CIRCL (2026-07-07)", "https://blog.zksecurity.xyz/posts/circl-bugs/" ], [ "Critical soundness bug in OpenVM, CVE-2026-46669 (2026-07-17)", "https://blog.zksecurity.xyz/posts/openvm-bugs/" ], [ "Four zero-days in bron-crypto (2026-07-22)", "https://blog.zksecurity.xyz/posts/bron-bugs/" ], [ "Aleo and Leo integration with cheatVM (2026-07-20)", "https://blog.zksecurity.xyz/posts/zkao-aleo-integration/" ] ], "page": "https://agentsast.com/tools/zkao/" }, { "slug": "zk-skills", "name": "zk-skills and circom-auditor", "tagline": "Open-source security skills for coding agents, scoring 66 of 70 on zkbugs", "maintainer": "zkSecurity", "url": "https://github.com/zksecurity/zk-skills", "repo": "https://github.com/zksecurity/zk-skills", "category": "crypto-zk", "targets": [ "Circom", "Claude Code", "Codex", "Cursor" ], "approach": "Agent skills (prompts, workflows and checklists) that turn a general coding agent into a Circom auditor", "license": "Open source (MIT)", "status": "Active (released 2026-08-05)", "since": "2026-08-05", "summary": "zk-skills is zkSecurity's open-source set of security skills for Claude Code, Codex and Cursor. Its circom-auditor skill scores 66 of 70 known bugs with Claude Opus 4.8 and 64 of 70 with GPT-5.5 on the zkbugs benchmark in direct mode, and 40 of 56 and 14 of 56 on full original codebases, against 30 of 70 and 8 of 56 for the Ecne tool. It is positioned as a pre-audit first pass, with zkao as the continuous deep option.", "details": [ "The skills package the same audit patterns zkao uses into files any team can drop into its agent. The gap between direct-mode and full-codebase scores is the honest number: pointing an agent at a whole repository is much harder than at a known-vulnerable template." ], "strengths": [ "Free, open and runnable today with the agent you already use.", "Benchmarked publicly in both easy and hard modes.", "Maintained by a firm that audits Circom for a living." ], "limits": [ "Circom only at release.", "Depends on the underlying model and your agent setup; results vary run to run.", "No validation layer; you triage everything." ], "fit": [ "Run zk-skills on every Circom change before an audit, and expect to spend the saved money on human triage." ], "references": [ [ "zk-skills repository", "https://github.com/zksecurity/zk-skills" ], [ "circom-auditor announcement (2026-08-05)", "https://blog.zksecurity.xyz/posts/circom-auditor/" ] ], "page": "https://agentsast.com/tools/zk-skills/" }, { "slug": "zkcraft", "name": "zkCraft (with zkFuzz)", "tagline": "Prompt-guided LLM mutation oracle on top of the zkFuzz circuit fuzzer", "maintainer": "Academic (Takahashi et al.)", "url": "https://arxiv.org/abs/2602.00667", "repo": "https://github.com/Koukyosyumei/zkFuzz", "category": "crypto-zk", "targets": [ "Circom", "Noir (preliminary)" ], "approach": "LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth", "license": "Open source", "status": "Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)", "summary": "zkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.", "details": [ "The combination matters because the fuzzer, not the model, decides what counts as a bug: an LLM hypothesis is only reported when a concrete trace violates the constraints. That eliminates hallucinated findings at the cost of missing bugs the mutation space cannot reach." ], "strengths": [ "Ground truth from execution, so no hallucinated findings.", "Strong published bug counts.", "Open source." ], "limits": [ "Circom focus; Noir preliminary.", "Cannot prove absence of bugs.", "Research maintenance cadence." ], "fit": [ "Pair with zk-skills or zkao: fuzzing for concrete underconstraint traces, agents for logic bugs." ], "references": [ [ "zkCraft (arXiv 2602.00667)", "https://arxiv.org/abs/2602.00667" ], [ "zkFuzz paper (arXiv 2504.11961)", "https://arxiv.org/abs/2504.11961" ], [ "zkFuzz repository", "https://github.com/Koukyosyumei/zkFuzz" ] ], "page": "https://agentsast.com/tools/zkcraft/" }, { "slug": "ai-grinding-cryptanalysis", "name": "AI Grinding for cryptanalysis (research)", "tagline": "Agents generate high-volume hypotheses; exact adversarial tests decide", "maintainer": "Olejnik and Naskrecki (academic)", "url": "https://arxiv.org/abs/2608.21986", "category": "crypto-zk", "targets": [ "Published cryptographic constructions", "Cryptanalysis" ], "approach": "Autonomous workflow: agents propose low-precision attack hypotheses, an exact, adversarially controlled test provides evidence", "license": "Research paper", "status": "Research (2026-08-22)", "summary": "A 2026 paper describing an autonomous cryptanalysis workflow in which agents produce many low-precision hypotheses and an exact, adversarially controlled test decides which count as evidence. It claims reproducible failures in eight published constructions and is the reference for applying the candidate-plus-oracle pattern to cryptography itself rather than code.", "details": [ "Together with zkSecurity's report on an LLM finding a flaw in a SNARG paper, it shows the method reaching cryptographic design, not only implementation." ], "strengths": [ "Exact tests remove hallucination.", "Targets design-level flaws." ], "limits": [ "Not a product.", "Requires building the exact test per construction.", "Claims await independent reproduction." ], "fit": [ "Read it if you design protocols; the pattern is what a serious AI cryptanalysis service will look like." ], "references": [ [ "AI Grinding for Fun and Cryptanalysis (arXiv 2608.21986)", "https://arxiv.org/abs/2608.21986" ], [ "When LLMs review cryptography papers (zkSecurity, 2026-02-10)", "https://blog.zksecurity.xyz/posts/llms-in-research/" ] ], "page": "https://agentsast.com/tools/ai-grinding-cryptanalysis/" }, { "slug": "claude-security", "name": "Claude Security", "tagline": "Anthropic's agentic vulnerability scanner, enterprise availability on Mythos-class models", "maintainer": "Anthropic", "url": "https://anthropic.com/news/claude-code-security", "category": "frontier", "targets": [ "General code", "Enterprise repositories", "Claude Code plugin" ], "approach": "Agentic multi-stage analysis that traces data flows and re-examines findings to filter false positives; findings carry CWE, severity and confidence; produces patch files", "license": "Enterprise SaaS, billed as token usage", "status": "Active (public beta May 2026; on Claude Mythos 5 from 2026-08-21)", "since": "2026-02-20", "summary": "Claude Security is Anthropic's vulnerability scanner, launched as Claude Code Security in a February 2026 research preview, opened to enterprises in May 2026 with a reported 2,100 vulnerabilities patched in three weeks, shipped as a Claude Code plugin in July 2026, and running on Claude Mythos 5 for enterprise customers from 21 August 2026. Anthropic's Project Glasswing partners reported more than 10,000 high or critical findings by May 2026, including the wolfSSL certificate-forgery CVE-2026-5194.", "details": [ "The scanner is general-purpose: it traces data flows, re-examines its own candidates and emits patches. It is the most widely deployed AI scanner in enterprises. On cryptographic code it finds implementation bugs; zkSecurity's comparisons show plain Claude runs finding five of seven CIRCL bugs when given cryptography skills, and missing the OpenVM soundness bug without a specialised harness." ], "strengths": [ "Scale of deployment and results.", "Integrated with Claude Code; emits patches.", "Confidence and CWE on every finding aid triage." ], "limits": [ "Not cryptography-aware; protocol and constraint bugs need domain skills or a specialist tool.", "Volume of findings creates triage burden.", "Enterprise plans only; model versions change under you." ], "fit": [ "Use it as the baseline scanner for the implementation layer of any codebase on a Claude enterprise plan, with zk-skills or zkao on the cryptographic core." ], "references": [ [ "Claude Code Security announcement", "https://anthropic.com/news/claude-code-security" ], [ "Project Glasswing initial update (2026-05-22)", "https://www.anthropic.com/research/glasswing-initial-update" ], [ "Claude Mythos 5 for defenders (2026-08-21)", "https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders" ] ], "page": "https://agentsast.com/tools/claude-security/" }, { "slug": "codex-security", "name": "Codex Security (formerly Aardvark)", "tagline": "OpenAI's agentic scanner with sandboxed exploit validation", "maintainer": "OpenAI", "url": "https://openai.com/index/codex-security-now-in-research-preview/", "category": "frontier", "targets": [ "General code", "Commits and pull requests" ], "approach": "Builds a project threat model, scans commits, validates exploitability in a sandbox, proposes patches", "license": "SaaS for ChatGPT Pro, Business, Enterprise and Edu", "status": "Active (research preview 2026-03-06)", "since": "2025-10 (Aardvark)", "summary": "Codex Security is OpenAI's agentic security scanner, announced as Aardvark in October 2025 with a claimed 92 percent detection rate on benchmark repositories and released as a research preview in March 2026. In its first thirty days it scanned 1.2 million commits, reported 792 critical and 10,561 high findings and 14 CVEs including OpenSSH, GnuTLS and Chromium, and claimed up to 84 percent noise reduction through sandboxed validation.", "details": [ "Sandboxed exploit validation is its distinguishing feature: a finding is confirmed by attempting it. The scale of high-severity findings in the first month is also the clearest illustration of triage burden on this index." ], "strengths": [ "Exploit validation before reporting.", "CVEs in cryptographic and network libraries (OpenSSH, GnuTLS).", "Threat-model construction per project." ], "limits": [ "Not cryptography-aware.", "Findings volume.", "Benchmark claims lack a public dataset." ], "fit": [ "Use it on ChatGPT enterprise plans as the implementation-layer scanner, with the same caveat as Claude Security for cryptographic logic." ], "references": [ [ "Introducing Aardvark (2025-10)", "https://openai.com/index/introducing-aardvark/" ], [ "Codex Security research preview (2026-03-06)", "https://openai.com/index/codex-security-now-in-research-preview/" ] ], "page": "https://agentsast.com/tools/codex-security/" }, { "slug": "big-sleep", "name": "Big Sleep and CodeMender", "tagline": "Google's LLM bug hunter and its patching companion", "maintainer": "Google DeepMind and Project Zero", "url": "https://blog.google/innovation-and-ai/technology/safety-security/cybersecurity-updates-summer-2025/", "category": "frontier", "targets": [ "C / C++ open source", "V8", "SQLite", "FFmpeg" ], "approach": "LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data", "license": "Big Sleep internal; CodeMender preview on Google Cloud; Flash Cyber gated to governments and partners", "status": "Active", "since": "2024 (Naptime)", "summary": "Big Sleep is Google's LLM-based bug hunter, credited with 20 flaws in FFmpeg and ImageMagick in August 2025 and with catching SQLite CVE-2025-6965 before exploitation. CodeMender (preview) validates and patches, and Gemini 3.5 Flash Cyber (July 2026) found 55 confirmed V8 issues. None is sold as a product to the public.", "details": [ "Google's work is the strongest evidence that frontier models find real memory-safety bugs in widely used C code. Access is the constraint: Big Sleep is internal and Flash Cyber is gated." ], "strengths": [ "Pre-exploitation catch in SQLite.", "Rigorous Project Zero disclosure.", "CodeMender closes the loop to patches." ], "limits": [ "Not available as a service.", "C and C++ focus.", "Not cryptography-aware." ], "fit": [ "Track its findings in your dependencies; you cannot run it yourself." ], "references": [ [ "Google cybersecurity updates (2025-08)", "https://blog.google/innovation-and-ai/technology/safety-security/cybersecurity-updates-summer-2025/" ], [ "CodeMender", "https://cloud.google.com/security/codemender" ], [ "Gemini 3.5 Flash Cyber (2026-07-21)", "https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/" ] ], "page": "https://agentsast.com/tools/big-sleep/" }, { "slug": "aisle", "name": "AISLE", "tagline": "Autonomous C analyzer credited with 12 of 12 OpenSSL CVEs in one release", "maintainer": "AISLE", "url": "https://aisle.com", "category": "frontier", "targets": [ "C source", "OpenSSL", "curl" ], "approach": "Autonomous analysis of C code with on-premises deployment option", "license": "Enterprise", "status": "Active", "summary": "AISLE is an autonomous analyzer for C source code credited with all twelve CVEs in OpenSSL's 27 January 2026 release (three dating to 1998 to 2000), twenty OpenSSL zero-days in six months, and six low-severity curl CVEs in August 2026 after curl's maintainer noted that Mythos and Codex Security had reported none.", "details": [ "AISLE's OpenSSL record is the most concentrated public result of any tool on a cryptographic library, although the bugs are implementation-level (parsing, memory) rather than cryptographic logic." ], "strengths": [ "Unmatched OpenSSL result count.", "On-prem option for sensitive code.", "Focused product." ], "limits": [ "C only.", "Implementation bugs, not protocol logic.", "Enterprise pricing; limited public methodology." ], "fit": [ "Choose AISLE for TLS stacks and C cryptographic libraries where memory-safety and parsing bugs dominate." ], "references": [ [ "12 of 12 OpenSSL vulnerabilities", "https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities" ], [ "Six curl CVEs (2026-08)", "https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero" ] ], "page": "https://agentsast.com/tools/aisle/" }, { "slug": "xbow", "name": "XBOW", "tagline": "Autonomous web penetration testing, top of HackerOne's US leaderboard", "maintainer": "XBOW", "url": "https://xbow.com", "category": "frontier", "targets": [ "Web applications", "Deployed services" ], "approach": "Autonomous black-box penetration testing agent", "license": "SaaS", "status": "Active (155 million dollar Series C in 2026)", "summary": "XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.", "details": [ "Relevant to a ZK or crypto product's web surface (APIs, dashboards, key-management portals), not to its cryptography." ], "strengths": [ "Proven against real bounty programs.", "No source access required." ], "limits": [ "Black-box web only.", "Not a code auditor." ], "fit": [ "Use for the web layer around a cryptographic service." ], "references": [ [ "XBOW", "https://xbow.com" ] ], "page": "https://agentsast.com/tools/xbow/" }, { "slug": "atlantis", "name": "Atlantis", "tagline": "AIxCC winner from Team Atlanta", "maintainer": "Team Atlanta (Georgia Tech, Samsung Research, KAIST, POSTECH)", "url": "https://team-atlanta.github.io/", "category": "aixcc", "targets": [ "C", "Java" ], "approach": "Ensemble of independent bug-finding modules sharing seeds, with eight patching agents", "license": "Open source", "status": "Open-sourced after the 2025-08-08 final", "summary": "Atlantis won DARPA's AI Cyber Challenge (4 million dollar first prize) with an ensemble of independent LLM and fuzzing modules that share seeds, and found the most real-world bugs in the final.", "details": [ "Its architecture, many diverse finders feeding one triage, is the pattern most commercial tools have since adopted." ], "strengths": [ "Best real-bug count in a controlled competition.", "Open source." ], "limits": [ "Heavy to deploy.", "C and Java only.", "Research code quality." ], "fit": [ "Study or self-host if you maintain large C infrastructure." ], "references": [ [ "Team Atlanta", "https://team-atlanta.github.io/" ], [ "DARPA AIxCC results (2025-08-08)", "https://www.darpa.mil/news/2025/aixcc-results" ] ], "page": "https://agentsast.com/tools/atlantis/" }, { "slug": "buttercup", "name": "Buttercup", "tagline": "Trail of Bits' laptop-runnable cyber reasoning system, AIxCC second place", "maintainer": "Trail of Bits", "url": "https://github.com/trailofbits/buttercup", "repo": "https://github.com/trailofbits/buttercup", "category": "aixcc", "targets": [ "C", "Java" ], "approach": "LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches", "license": "Open source", "status": "Open-sourced 2025", "summary": "Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.", "details": [ "Buttercup is the cheapest credible starting point for self-hosted AI bug finding on C code, and its author firm uses AI across its audit practice." ], "strengths": [ "Cheap and self-hostable.", "High accuracy in the final.", "Maintained by an audit firm." ], "limits": [ "C and Java.", "Fuzzing-dependent: needs harnesses.", "Not cryptography-aware." ], "fit": [ "Run on C cryptographic libraries with existing fuzz harnesses." ], "references": [ [ "Buttercup repository", "https://github.com/trailofbits/buttercup" ] ], "page": "https://agentsast.com/tools/buttercup/" }, { "slug": "roboduck", "name": "RoboDuck", "tagline": "Theori's LLM-only proof-of-vulnerability pipeline, AIxCC third place", "maintainer": "Theori", "url": "https://theori.io", "category": "aixcc", "targets": [ "C", "Java" ], "approach": "LLM-only pipeline with no fuzzing or symbolic execution", "license": "Open source", "status": "Open-sourced 2025", "summary": "RoboDuck placed third in AIxCC (1.5 million dollars) with a pipeline that relies on LLM reasoning alone to produce proofs of vulnerability, without fuzzing or symbolic execution.", "details": [ "It is the cleanest measurement of what models alone achieve under competition rules, and the baseline the hybrid systems beat." ], "strengths": [ "Simple architecture.", "Competitive result without fuzzing." ], "limits": [ "No execution ground truth.", "C and Java." ], "fit": [ "Read it to understand the ceiling of pure-LLM approaches." ], "references": [ [ "DARPA AIxCC results (2025-08-08)", "https://www.darpa.mil/news/2025/aixcc-results" ], [ "AIxCC systems SoK (arXiv 2602.07666)", "https://arxiv.org/abs/2602.07666" ] ], "page": "https://agentsast.com/tools/roboduck/" }, { "slug": "oss-crs", "name": "OSS-CRS and other AIxCC finalists", "tagline": "OpenSSF's integrated distribution of ARTIPHISHELL, BugBuster, Lacrosse and others", "maintainer": "OpenSSF and the AIxCC finalist teams", "url": "https://arxiv.org/abs/2602.07666", "category": "aixcc", "targets": [ "C", "Java", "OSS-Fuzz projects" ], "approach": "Packaging of finalist components (Shellphish ARTIPHISHELL, 42-b3yond-6ug BugBuster, all-you-need-is-a-fuzzing-brain, Lacrosse) for open-source maintainers", "license": "Open source", "status": "Active", "summary": "OSS-CRS is OpenSSF's effort to integrate the open-sourced AIxCC finalist systems, including Shellphish's ARTIPHISHELL, BugBuster, all-you-need-is-a-fuzzing-brain and Lacrosse, so open-source maintainers can run them against OSS-Fuzz projects.", "details": [ "For cryptographic libraries already in OSS-Fuzz, this is the lowest-friction route to AIxCC-class scanning." ], "strengths": [ "Maintainer-oriented packaging.", "Multiple systems in one." ], "limits": [ "Early integration.", "Requires OSS-Fuzz style harnesses." ], "fit": [ "Use if your library is in OSS-Fuzz." ], "references": [ [ "AIxCC systems SoK (arXiv 2602.07666)", "https://arxiv.org/abs/2602.07666" ] ], "page": "https://agentsast.com/tools/oss-crs/" }, { "slug": "sherlock-ai", "name": "Sherlock AI", "tagline": "Solidity auditor with a controlled precision study", "maintainer": "Sherlock", "url": "https://sherlock.xyz/solutions/ai", "category": "smart-contracts", "targets": [ "Solidity", "EVM" ], "approach": "Multi-step LLM reasoning trained on top researchers' findings; GitHub PR integration; codebase chat; verification tests for fixes", "license": "Commercial (contact sales)", "status": "Active (v2 May 2026)", "summary": "Sherlock AI is Sherlock's Solidity auditor. In Sherlock's own controlled benchmark on the Flayer and Moongate codebase, scored by an independent researcher, version 2.2 produced 21 valid findings out of 38 (55 percent precision) against 4 of 8 for GPT-5.2 and 1 of 16 for Claude Sonnet 4.5.", "details": [ "It is one of the few vendors to publish a precision number rather than only recall, and to integrate with the pull-request flow." ], "strengths": [ "Published precision.", "PR-native workflow.", "Backed by a contest platform with human researchers." ], "limits": [ "Solidity only.", "Vendor-run benchmark.", "Pricing not public." ], "fit": [ "Choose for EVM protocols that want AI in the PR loop with a path to Sherlock's human contests." ], "references": [ [ "Sherlock AI", "https://sherlock.xyz/solutions/ai" ], [ "Controlled benchmark vs ChatGPT and Claude", "https://sherlock.xyz/post/controlled-benchmark-chatgpt-and-claude-vs-sherlock-ai" ] ], "page": "https://agentsast.com/tools/sherlock-ai/" }, { "slug": "auditagent", "name": "AuditAgent", "tagline": "Nethermind's pair auditor with published recall on real audits", "maintainer": "Nethermind Security", "url": "https://auditagent.nethermind.io", "category": "smart-contracts", "targets": [ "EVM", "Solana", "Starknet" ], "approach": "LLM agent run after manual review as a second layer", "license": "SaaS", "status": "Active", "summary": "AuditAgent is Nethermind's smart-contract auditing agent. On 29 real Nethermind audits it averaged 30 percent recall (up to 50 percent), catching 42 percent of criticals and 43 percent of highs and finding valid issues in 62 percent of projects; on EVMbench it reported 67 percent post-validation recall against 47 percent for Claude Opus 4.6 and 38 percent for GPT-5.2. It retroactively flagged the ResupplyFi exploit.", "details": [ "Nethermind's transparency about real-audit recall is the most useful data point on this index for setting expectations: a good AI auditor finds roughly a third of what a human team finds, and is worth running because the third is not the same third." ], "strengths": [ "Honest, published recall on real engagements.", "Multi-chain.", "Positioned correctly as a second layer." ], "limits": [ "30 percent average recall.", "Post-validation numbers depend on human triage.", "Not for circuits." ], "fit": [ "Run after a human audit on EVM, Solana or Starknet contracts." ], "references": [ [ "How Nethermind uses AuditAgent alongside manual audits (2025-10-01)", "https://www.nethermind.io/blog/how-nethermind-security-uses-auditagent-alongside-manual-audits" ], [ "AuditAgent on EVMbench (2026-04-29)", "https://www.nethermind.io/blog/auditagent-on-evmbench-what-the-data-shows" ] ], "page": "https://agentsast.com/tools/auditagent/" }, { "slug": "zellic-v12", "name": "Zellic V12", "tagline": "LLM plus static analysis for the coding-mistake majority of Solidity bugs", "maintainer": "Zellic", "url": "https://www.zellic.io/blog/introducing-v12/", "category": "smart-contracts", "targets": [ "Solidity" ], "approach": "LLM combined with static analysis, aimed at the roughly 70 percent of bugs that are coding mistakes", "license": "Announced as free; current availability and pricing not confirmed", "status": "Active (announced 2025-09-25)", "summary": "Zellic V12 is an autonomous Solidity auditor combining LLMs with static analysis. Zellic reported 39 findings across live audits, Cantina contests and a Pendle bug, and a 70.6 percent detect score on EVMbench (March 2026). Its co-founder describes it as matching junior auditors but not top firms.", "details": [ "Zellic also owns Code4rena, which announced it is closing, a data point on how AI is reshaping contest economics." ], "strengths": [ "High EVMbench detect score.", "Real findings in contests.", "Built by a top audit firm." ], "limits": [ "Solidity only.", "Availability unclear.", "EVMbench contamination caveats apply." ], "fit": [ "Use if available; treat as a junior-auditor pass." ], "references": [ [ "Introducing V12 (2025-09-25)", "https://www.zellic.io/blog/introducing-v12/" ] ], "page": "https://agentsast.com/tools/zellic-v12/" }, { "slug": "savant-chat", "name": "Savant Chat", "tagline": "Multi-agent auditor covering Solidity, Rust, Move, Cairo and ZK circuit languages", "maintainer": "Novel Codes DMCC", "url": "https://savant.chat", "category": "smart-contracts", "targets": [ "Solidity", "Vyper", "Rust", "Move", "Cairo", "FunC", "Circom", "Halo2", "Noir", "arkworks" ], "approach": "Multi-agent LLM stack across 200+ vulnerability classes; critic subagent writes a PoC per finding on higher tiers", "license": "Pay per line (0.07 to 0.50 dollars) or 250 to 2,500 dollars per month; 75 dollars free credits", "status": "Active", "summary": "Savant Chat is a multi-agent auditor with the broadest language list on this index, including Circom, Halo2, Noir and arkworks alongside Solidity, Rust, Move and Cairo. It placed sixth in Sherlock's Symbiotic contest in September 2025, a contest with no high or critical findings.", "details": [ "Its ZK language support is listed but has no public ZK case study; the contest result is on Solidity." ], "strengths": [ "Broadest coverage.", "Transparent pricing and a free tier.", "PoC per finding on higher tiers." ], "limits": [ "No public ZK results.", "Contest result is modest.", "Per-line pricing scales with codebase." ], "fit": [ "Try on mixed Solidity and circuit repositories; validate ZK findings with a specialist." ], "references": [ [ "Savant Chat", "https://savant.chat" ], [ "Sherlock Symbiotic contest result (2025-09-02)", "https://www.globenewswire.com/news-release/2025/09/02/3143051/0/en/Savant-Chat-achieves-a-historic-top-6-ranking-in-the-Sherlock-DeFi-Audit-Contest.html" ] ], "page": "https://agentsast.com/tools/savant-chat/" }, { "slug": "olympix", "name": "Olympix", "tagline": "Per-commit Solidity security with symbolic execution, fuzzing, mutation testing and AI", "maintainer": "Olympix", "url": "https://olympix.security", "category": "smart-contracts", "targets": [ "Solidity" ], "approach": "IR and custom detectors, symbolic execution, fuzzing, mutation testing plus AI, with executable PoCs, run per commit", "license": "Commercial CI tool", "status": "Active (founded 2022)", "summary": "Olympix is a commercial CI tool for Solidity that combines an intermediate representation, custom detectors, symbolic execution, fuzzing and mutation testing with AI, producing executable proofs of concept on every commit.", "details": [ "Its emphasis on execution-backed findings is the right design for low false-positive rates." ], "strengths": [ "Executable PoCs.", "Per-commit.", "Multiple analysis engines." ], "limits": [ "Solidity only.", "Commercial, limited public benchmarks." ], "fit": [ "Choose for continuous EVM coverage in CI." ], "references": [ [ "Olympix", "https://olympix.security" ] ], "page": "https://agentsast.com/tools/olympix/" }, { "slug": "octane", "name": "Octane Security", "tagline": "Continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos", "maintainer": "Octane", "url": "https://www.octane.security", "category": "smart-contracts", "targets": [ "EVM", "Solana", "Aptos", "Sui", "Cosmos" ], "approach": "Continuous AI scanning with automated fixes", "license": "Commercial", "status": "Active (6.75 million dollar seed)", "summary": "Octane provides continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos, backed by a seed round led by Archetype and Winklevoss Capital.", "details": [ "Broad chain coverage; public accuracy data is limited." ], "strengths": [ "Multi-chain.", "Fix generation." ], "limits": [ "Limited public benchmarks.", "Not for circuits." ], "fit": [ "Consider for multi-chain protocols wanting continuous scanning." ], "references": [ [ "Octane Security", "https://www.octane.security" ] ], "page": "https://agentsast.com/tools/octane/" }, { "slug": "hound", "name": "Hound", "tagline": "Open-source, language-agnostic auditing agent with relation-first knowledge graphs", "maintainer": "Bernhard Mueller (scabench-org)", "url": "https://github.com/scabench-org/hound", "repo": "https://github.com/scabench-org/hound", "category": "smart-contracts", "targets": [ "Language-agnostic", "Solidity" ], "approach": "Relation-first knowledge graphs, persistent vulnerability hypotheses, scout and strategist model switching", "license": "Open source", "status": "Active (paper 2025-10)", "summary": "Hound is an open-source auditing agent that builds relation-first knowledge graphs of a codebase and maintains persistent vulnerability hypotheses. On a ScaBench subset it reported 34 true positives against 9 for the baseline, with recall of 31.2 percent versus 8.3 percent.", "details": [ "Hound and ScaBench come from the same author, giving an unusually transparent tool-plus-benchmark pair." ], "strengths": [ "Open source with a public benchmark.", "Language-agnostic design.", "Documented architecture." ], "limits": [ "31 percent recall.", "Single-maintainer project." ], "fit": [ "Use to understand agentic auditing, or as a free second opinion." ], "references": [ [ "Hound repository", "https://github.com/scabench-org/hound" ], [ "Hound paper (arXiv 2510.09633)", "https://arxiv.org/abs/2510.09633" ] ], "page": "https://agentsast.com/tools/hound/" }, { "slug": "quillshield", "name": "QuillShield", "tagline": "QuillAudits' AI auditor and open-source Claude skills", "maintainer": "QuillAudits", "url": "https://shield.quillai.network", "category": "smart-contracts", "targets": [ "Solidity" ], "approach": "AI audits plus open-source Claude skills using a 'Semantic State Protocol' (behavioral decomposition, threat modeling, adversarial simulation, risk scoring)", "license": "Commercial; skills open source", "status": "Active", "summary": "QuillShield is QuillAudits' AI auditing product for Solidity, complemented by open-source Claude skills that decompose contract behaviour, model threats and simulate adversaries.", "details": [ "Follows the same open-skills pattern as zkSecurity's zk-skills, for EVM." ], "strengths": [ "Open skills.", "Backed by a human audit firm." ], "limits": [ "Solidity only.", "Limited public benchmarks." ], "fit": [ "Try the skills as a free EVM first pass." ], "references": [ [ "QuillShield", "https://shield.quillai.network" ], [ "QuillAudits Claude skills", "https://www.quillaudits.com/blog/ai-agents/first-version-claude-skills" ] ], "page": "https://agentsast.com/tools/quillshield/" }, { "slug": "cecuro", "name": "Cecuro", "tagline": "DeFi exploit-detection agent with an open benchmark of 90 exploited contracts", "maintainer": "Cecuro", "url": "https://cecuro.ai/blog/97m-defi-exploits-preventable-specialized-ai", "category": "smart-contracts", "targets": [ "DeFi contracts" ], "approach": "Specialised agent; benchmark and baseline open-sourced, agent withheld", "license": "Commercial", "status": "Active", "summary": "Cecuro published a benchmark of 90 contracts exploited between October 2024 and early 2026 (228 million dollars lost) and reports its agent detecting 92 percent of the value at risk against 34 percent for a baseline GPT-5.1 agent. The benchmark and baseline are open; the agent is not.", "details": [ "A retrospective benchmark on already-public exploits is contamination-prone; read the number accordingly." ], "strengths": [ "Open benchmark.", "Loss-weighted scoring." ], "limits": [ "Retrospective and contamination-prone.", "Closed agent." ], "fit": [ "Use the benchmark; evaluate the agent on private code." ], "references": [ [ "Cecuro benchmark post", "https://cecuro.ai/blog/97m-defi-exploits-preventable-specialized-ai" ] ], "page": "https://agentsast.com/tools/cecuro/" }, { "slug": "certora-ai-composer", "name": "Certora AI Composer", "tagline": "LLM code generation with the Certora Prover checking invariants in the loop", "maintainer": "Certora", "url": "https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform", "category": "smart-contracts", "targets": [ "Solidity" ], "approach": "Secure generation: model writes code, the formal prover checks invariants before acceptance", "license": "Open source alpha (2025-12-04)", "status": "Alpha", "summary": "Certora AI Composer pairs LLM code generation with the Certora Prover so generated Solidity is checked against invariants before it is accepted. It is a secure-generation tool rather than a scanner, and the clearest example of LLM plus formal verification.", "details": [ "The pattern, model proposes and prover disposes, is the same one better.codes and Clean use in the ZK world." ], "strengths": [ "Proof-checked output.", "Open source." ], "limits": [ "Alpha.", "Generation, not auditing.", "Invariants must be written." ], "fit": [ "Use when generating contract code that has formal specs." ], "references": [ [ "Certora AI Composer", "https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform" ] ], "page": "https://agentsast.com/tools/certora-ai-composer/" }, { "slug": "immunefi-magnus", "name": "Immunefi Magnus", "tagline": "SecOps platform with AI security swarm and AI fuzzing", "maintainer": "Immunefi", "url": "https://immunefi.com/blog/magnus/introducing-magnus/", "category": "smart-contracts", "targets": [ "Smart contracts", "Bounty programs" ], "approach": "Security Swarm agents, Fuzzland AI fuzzing integration, CODEX vulnerability dataset", "license": "Commercial platform", "status": "Active", "summary": "Magnus is Immunefi's security operations platform combining Security Swarm AI agents, Fuzzland's AI fuzzing and the CODEX vulnerability dataset with its bounty infrastructure.", "details": [ "Its value is the dataset and the disclosure plumbing as much as the agents." ], "strengths": [ "Bounty integration.", "Large vulnerability dataset." ], "limits": [ "Platform, not a standalone scanner.", "Public accuracy data limited." ], "fit": [ "Consider if you already run a bounty program with Immunefi." ], "references": [ [ "Introducing Magnus", "https://immunefi.com/blog/magnus/introducing-magnus/" ] ], "page": "https://agentsast.com/tools/immunefi-magnus/" }, { "slug": "zkbugs", "name": "zkbugs", "tagline": "The ZK-specific vulnerability benchmark and knowledge base", "maintainer": "zkSecurity", "url": "https://github.com/zksecurity/zkbugs", "repo": "https://github.com/zksecurity/zkbugs", "category": "benchmarks", "targets": [ "Circom", "ZK DSLs", "139 catalogued vulnerabilities" ], "approach": "Reproducible vulnerable circuits with direct and full-codebase evaluation modes; public knowledge base at bugs.zksecurity.xyz", "license": "Open source", "status": "Active", "summary": "zkbugs is zkSecurity's benchmark and knowledge base of zero-knowledge circuit vulnerabilities (139 catalogued across ZK DSLs), with reproducible cases used to score zk-skills at 66 of 70 in direct mode and 40 of 56 on full codebases. The companion site bugs.zksecurity.xyz is the public ZK bug tracker.", "details": [ "It is the only ZK-specific benchmark, and its two modes make the difficulty gap between template-level and repository-level detection visible." ], "strengths": [ "Only ZK benchmark.", "Two difficulty modes.", "Public knowledge base." ], "limits": [ "Circom-heavy.", "Known bugs may be in training data." ], "fit": [ "Score any ZK tool on it and report both modes." ], "references": [ [ "zkbugs repository", "https://github.com/zksecurity/zkbugs" ], [ "ZK Bug Tracker", "https://bugs.zksecurity.xyz" ], [ "zkbugs website post", "https://blog.zksecurity.xyz/posts/zkbugs-website/" ] ], "page": "https://agentsast.com/tools/zkbugs/" }, { "slug": "evmbench", "name": "EVMbench", "tagline": "OpenAI and Paradigm's Solidity benchmark, with OpenZeppelin's corrections", "maintainer": "OpenAI and Paradigm", "url": "https://github.com/paradigmxyz/evmbench", "repo": "https://github.com/paradigmxyz/evmbench", "category": "benchmarks", "targets": [ "Solidity", "117 vulnerabilities from 40 audits" ], "approach": "Detect, patch and exploit modes", "license": "Open source", "status": "Active (released 2026-02-18)", "summary": "EVMbench contains 117 vulnerabilities from 40 audits with detect, patch and exploit modes; GPT-5.3-Codex scored 72.2 percent in exploit mode against 31.9 percent for GPT-5. OpenZeppelin's audit found at least four invalid high-severity items and training-data contamination risk, and a re-evaluation paper followed.", "details": [ "The most cited and most contested smart-contract benchmark. Use it with the corrections." ], "strengths": [ "Three task modes.", "Widely reported scores." ], "limits": [ "Contamination risk.", "Invalid items identified by OpenZeppelin.", "Recall-only scoring hides false positives." ], "fit": [ "Use with OpenZeppelin's corrections and alongside ScaBench." ], "references": [ [ "EVMbench", "https://github.com/paradigmxyz/evmbench" ], [ "OpenAI announcement", "https://openai.com/index/introducing-evmbench/" ], [ "OpenZeppelin audit of EVMbench (2026-03-02)", "https://www.openzeppelin.com/news/openai-evmbench-audit" ], [ "Re-evaluation paper (arXiv 2603.10795)", "https://arxiv.org/abs/2603.10795" ] ], "page": "https://agentsast.com/tools/evmbench/" }, { "slug": "scabench", "name": "ScaBench and SCONE-bench", "tagline": "Contest-derived and Anthropic smart-contract benchmarks", "maintainer": "scabench-org; Anthropic", "url": "https://github.com/scabench-org/scabench", "repo": "https://github.com/anthropics/scone-bench", "category": "benchmarks", "targets": [ "Solidity", "31 projects from Code4rena, Cantina, Sherlock" ], "approach": "Ground truth from public contest findings; SCONE-bench from Anthropic", "license": "Open source", "status": "Active", "summary": "ScaBench draws ground truth from 31 projects audited on Code4rena, Cantina and Sherlock and is the benchmark behind Hound's published recall; SCONE-bench is Anthropic's smart-contract benchmark.", "details": [ "Contest-derived benchmarks have many human findings per project, which makes recall numbers harsher and more realistic." ], "strengths": [ "Realistic ground truth.", "Open." ], "limits": [ "Public findings are in training data.", "Solidity only." ], "fit": [ "Use alongside EVMbench." ], "references": [ [ "ScaBench", "https://github.com/scabench-org/scabench" ], [ "SCONE-bench", "https://github.com/anthropics/scone-bench" ] ], "page": "https://agentsast.com/tools/scabench/" }, { "slug": "cybergym", "name": "CyberGym, BountyBench and SEC-bench", "tagline": "General-software benchmarks for AI vulnerability discovery", "maintainer": "Academic", "url": "https://arxiv.org/abs/2506.02548", "category": "benchmarks", "targets": [ "General software", "1,507 CyberGym instances from 188 projects", "40 BountyBench tasks" ], "approach": "Reproduce real vulnerabilities from crash inputs (CyberGym), offence and defence bounty tasks (BountyBench), end-to-end PoC generation (SEC-bench)", "license": "Open source", "status": "Active", "summary": "CyberGym (1,507 instances from 188 projects, with an end-to-end variant), BountyBench (40 offence and defence tasks) and SEC-bench are the main general-software benchmarks for AI vulnerability discovery, and the ones frontier labs cite.", "details": [ "Cryptographic libraries appear in these datasets as C projects, so scores are relevant to implementation-level bugs." ], "strengths": [ "Large, reproducible.", "Execution-based scoring." ], "limits": [ "General code, not cryptographic logic.", "Rapid saturation by new models." ], "fit": [ "Use for general scanners; not sufficient for crypto-specific claims." ], "references": [ [ "CyberGym", "https://arxiv.org/abs/2506.02548" ], [ "CyberGym-E2E", "https://arxiv.org/html/2606.04460" ], [ "BountyBench", "https://arxiv.org/abs/2505.15216" ], [ "SEC-bench", "https://arxiv.org/abs/2506.11791" ] ], "page": "https://agentsast.com/tools/cybergym/" }, { "slug": "gptscan-propertygpt", "name": "GPTScan and PropertyGPT (research)", "tagline": "The papers that established LLM plus static analysis and LLM plus formal verification", "maintainer": "Academic", "url": "https://arxiv.org/abs/2308.03314", "category": "benchmarks", "targets": [ "Solidity" ], "approach": "GPTScan: GPT plus static analysis for logic bugs (ICSE 2024); PropertyGPT: retrieval-augmented generation of formal properties (NDSS 2025)", "license": "Research", "status": "Published", "summary": "GPTScan (ICSE 2024) combined GPT with static analysis for Solidity logic bugs, reporting over 90 percent precision on token contracts and 57 percent on large projects with 9 new bugs. PropertyGPT (NDSS 2025) generates formal properties for smart contracts with retrieval augmentation, the ancestor of LLM plus prover tools.", "details": [ "These two papers define the two hybrid patterns most commercial tools now use." ], "strengths": [ "Peer reviewed.", "Clear methodology." ], "limits": [ "Older models.", "Research code." ], "fit": [ "Read for the methods; do not deploy directly." ], "references": [ [ "GPTScan (arXiv 2308.03314)", "https://arxiv.org/abs/2308.03314" ], [ "PropertyGPT (arXiv 2405.02580)", "https://arxiv.org/abs/2405.02580" ] ], "page": "https://agentsast.com/tools/gptscan-propertygpt/" } ]