{
  "slug": "frontier",
  "name": "Frontier-lab and general scanners",
  "short": "general-code scanning",
  "title": "Frontier-lab AI security scanners: Claude Security, Codex Security, Big Sleep, CodeMender, AISLE, XBOW compared",
  "summary": "General-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.",
  "intro": [
    "2026 is the year the frontier labs shipped security scanning as a product: Anthropic's Claude Security moved from research preview (February) to enterprise availability on its Mythos-class models (August), OpenAI's Aardvark became Codex Security (March) and reported 14 CVEs in its first month, and Google paired Big Sleep with CodeMender and a cyber-tuned Gemini model. Independent AISLE, focused on C, claimed all twelve CVEs in a single OpenSSL release.",
    "For cryptography teams the lesson is mixed. These tools find memory-safety and logic bugs in crypto libraries because those libraries are C and Rust. They do not reason about the mathematics, and zkSecurity's comparisons show plain frontier-model runs missing the critical OpenVM soundness bug that a cryptography-specific harness found. Use them for the implementation layer, not the protocol."
  ],
  "choose": [
    "Enterprise repositories on Claude or ChatGPT plans: **Claude Security** or **Codex Security**, priced as token usage or subscription; expect a large volume of findings to triage.",
    "C libraries where memory-safety bugs dominate (TLS stacks, parsers): **AISLE**, or the open-source **AIxCC** systems.",
    "Web application penetration testing rather than code review: **XBOW**.",
    "Cryptographic protocol logic: none of these. Pair with a cryptography-specific tool and human cryptographers."
  ],
  "tools": [
    {
      "name": "Claude Security",
      "page": "https://agentsast.com/tools/claude-security/"
    },
    {
      "name": "Codex Security (formerly Aardvark)",
      "page": "https://agentsast.com/tools/codex-security/"
    },
    {
      "name": "Big Sleep and CodeMender",
      "page": "https://agentsast.com/tools/big-sleep/"
    },
    {
      "name": "AISLE",
      "page": "https://agentsast.com/tools/aisle/"
    },
    {
      "name": "XBOW",
      "page": "https://agentsast.com/tools/xbow/"
    }
  ],
  "page": "https://agentsast.com/categories/frontier/",
  "updated": "2026-09-13"
}