Frontier-lab AI security scanners: Claude Security, Codex Security, Big Sleep, CodeMender, AISLE, XBOW compared
================================================================================

General-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.

Claude Security: Anthropic — General code, Enterprise repositories, Claude Code plugin — Agentic multi-stage analysis that traces data flows and re-examines findings to filter false positives; findings carry CWE, severity and confidence; produces patch files — Active (public beta May 2026; on Claude Mythos 5 from 2026-08-21)
Codex Security (formerly Aardvark): OpenAI — General code, Commits and pull requests — Builds a project threat model, scans commits, validates exploitability in a sandbox, proposes patches — Active (research preview 2026-03-06)
Big Sleep and CodeMender: Google DeepMind and Project Zero — C / C++ open source, V8, SQLite, FFmpeg — LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data — Active
AISLE: AISLE — C source, OpenSSL, curl — Autonomous analysis of C code with on-premises deployment option — Active
XBOW: XBOW — Web applications, Deployed services — Autonomous black-box penetration testing agent — Active (155 million dollar Series C in 2026)
How to choose: Enterprise repositories on Claude or ChatGPT plans: **Claude Security** or **Codex Security**, priced as token usage or subscription; expect a large volume of findings to triage. | C libraries where memory-safety bugs dominate (TLS stacks, parsers): **AISLE**, or the open-source **AIxCC** systems. | Web application penetration testing rather than code review: **XBOW**. | Cryptographic protocol logic: none of these. Pair with a cryptography-specific tool and human cryptographers.

Source page: https://agentsast.com/categories/frontier/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13