Frontier-lab and general scanners

Direct answerGeneral-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.

2026 is the year the frontier labs shipped security scanning as a product: Anthropic's Claude Security moved from research preview (February) to enterprise availability on its Mythos-class models (August), OpenAI's Aardvark became Codex Security (March) and reported 14 CVEs in its first month, and Google paired Big Sleep with CodeMender and a cyber-tuned Gemini model. Independent AISLE, focused on C, claimed all twelve CVEs in a single OpenSSL release.

For cryptography teams the lesson is mixed. These tools find memory-safety and logic bugs in crypto libraries because those libraries are C and Rust. They do not reason about the mathematics, and zkSecurity's comparisons show plain frontier-model runs missing the critical OpenVM soundness bug that a cryptography-specific harness found. Use them for the implementation layer, not the protocol.

Tools in this category

Tool	Targets	Approach	Access	Status
Claude Security Anthropic	General codeEnterprise repositoriesClaude Code plugin	Agentic multi-stage analysis that traces data flows and re-examines findings to filter false positives; findings carry CWE, severity and confidence; produces patch files	Enterprise SaaS, billed as token usage	Active (public beta May 2026; on Claude Mythos 5 from 2026-08-21)
Codex Security (formerly Aardvark) OpenAI	General codeCommits and pull requests	Builds a project threat model, scans commits, validates exploitability in a sandbox, proposes patches	SaaS for ChatGPT Pro, Business, Enterprise and Edu	Active (research preview 2026-03-06)
Big Sleep and CodeMender Google DeepMind and Project Zero	C / C++ open sourceV8SQLiteFFmpeg	LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data	Big Sleep internal; CodeMender preview on Google Cloud; Flash Cyber gated to governments and partners	Active
AISLE AISLE	C sourceOpenSSLcurl	Autonomous analysis of C code with on-premises deployment option	Enterprise	Active
XBOW XBOW	Web applicationsDeployed services	Autonomous black-box penetration testing agent	SaaS	Active (155 million dollar Series C in 2026)

How to choose

Enterprise repositories on Claude or ChatGPT plans: Claude Security or Codex Security, priced as token usage or subscription; expect a large volume of findings to triage.
C libraries where memory-safety bugs dominate (TLS stacks, parsers): AISLE, or the open-source AIxCC systems.
Web application penetration testing rather than code review: XBOW.
Cryptographic protocol logic: none of these. Pair with a cryptography-specific tool and human cryptographers.

Firms that do this work

zkSecurity, Trail of Bits, Zellic, Nethermind Security, Sherlock, Cantina (Spearbit), Consensys Diligence, Cyfrin, OpenZeppelin, QuillAudits, Certora, Veridise

Top-listed for general-code scanning work: zkSecurity
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website

Other categories

Cryptography and ZK specialists, Cyber reasoning systems (DARPA AIxCC), Smart-contract AI auditors, Benchmarks and research

Last reviewed 2026-09-13 by the agentsast editors. Machine-readable: data.json · summary.txt