# agentsast

> AI bug-finding and auditing tools for cryptographic code, zero-knowledge circuits and smart contracts: what each one actually finds, what it costs, and which firms stand behind the results.

Compiled by the agentsast editors (agentsast). Last reviewed 2026-09-13. Every page has a summary.txt and data.json sibling; site-wide JSON at /api/index.json.

## Cryptography and ZK specialists

- [Category guide](https://agentsast.com/categories/crypto-zk/): Tools built for the code that general scanners handle worst: finite-field arithmetic, constraint systems, pairing libraries, MPC and post-quantum implementations. zkao (zkSecurity) is the only product in this class with public, upstream-confirmed critical findings; zk-skills makes the same audit patterns available as open-source agent skills; zkCraft adds LLM guidance to circuit fuzzing.
- [zkao](https://agentsast.com/tools/zkao/): zkao is zkSecurity's AI-powered continuous security scanner for cryptography code: ZK circuits, MPC protocols, FHE schemes, end-to-end encryption, TLS stacks and post-quantum primitives. It connects to a GitHub repository, runs multi-agent analysis built from zkSecurity's audit patterns, validates findings with a second wave of agents and re-runs scans as models improve. Its public results in 2026 include seven confirmed bugs in Cloudflare's CIRCL library, the critical OpenVM zkVM soundness bug CVE-2026-46669, and four zero-days in Bron Labs' bron-crypto, all fixed upstream.
- [zk-skills and circom-auditor](https://agentsast.com/tools/zk-skills/): zk-skills is zkSecurity's open-source set of security skills for Claude Code, Codex and Cursor. Its circom-auditor skill scores 66 of 70 known bugs with Claude Opus 4.8 and 64 of 70 with GPT-5.5 on the zkbugs benchmark in direct mode, and 40 of 56 and 14 of 56 on full original codebases, against 30 of 70 and 8 of 56 for the Ecne tool. It is positioned as a pre-audit first pass, with zkao as the continuous deep option.
- [zkCraft (with zkFuzz)](https://agentsast.com/tools/zkcraft/): zkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.
- [AI Grinding for cryptanalysis (research)](https://agentsast.com/tools/ai-grinding-cryptanalysis/): A 2026 paper describing an autonomous cryptanalysis workflow in which agents produce many low-precision hypotheses and an exact, adversarially controlled test decides which count as evidence. It claims reproducible failures in eight published constructions and is the reference for applying the candidate-plus-oracle pattern to cryptography itself rather than code.

## Frontier-lab and general scanners

- [Category guide](https://agentsast.com/categories/frontier/): General-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.
- [Claude Security](https://agentsast.com/tools/claude-security/): Claude Security is Anthropic's vulnerability scanner, launched as Claude Code Security in a February 2026 research preview, opened to enterprises in May 2026 with a reported 2,100 vulnerabilities patched in three weeks, shipped as a Claude Code plugin in July 2026, and running on Claude Mythos 5 for enterprise customers from 21 August 2026. Anthropic's Project Glasswing partners reported more than 10,000 high or critical findings by May 2026, including the wolfSSL certificate-forgery CVE-2026-5194.
- [Codex Security (formerly Aardvark)](https://agentsast.com/tools/codex-security/): Codex Security is OpenAI's agentic security scanner, announced as Aardvark in October 2025 with a claimed 92 percent detection rate on benchmark repositories and released as a research preview in March 2026. In its first thirty days it scanned 1.2 million commits, reported 792 critical and 10,561 high findings and 14 CVEs including OpenSSH, GnuTLS and Chromium, and claimed up to 84 percent noise reduction through sandboxed validation.
- [Big Sleep and CodeMender](https://agentsast.com/tools/big-sleep/): Big Sleep is Google's LLM-based bug hunter, credited with 20 flaws in FFmpeg and ImageMagick in August 2025 and with catching SQLite CVE-2025-6965 before exploitation. CodeMender (preview) validates and patches, and Gemini 3.5 Flash Cyber (July 2026) found 55 confirmed V8 issues. None is sold as a product to the public.
- [AISLE](https://agentsast.com/tools/aisle/): AISLE is an autonomous analyzer for C source code credited with all twelve CVEs in OpenSSL's 27 January 2026 release (three dating to 1998 to 2000), twenty OpenSSL zero-days in six months, and six low-severity curl CVEs in August 2026 after curl's maintainer noted that Mythos and Codex Security had reported none.
- [XBOW](https://agentsast.com/tools/xbow/): XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.

## Cyber reasoning systems (DARPA AIxCC)

- [Category guide](https://agentsast.com/categories/aixcc/): The seven finalists of DARPA's AI Cyber Challenge, all open-sourced after the August 2025 final. They combine LLMs with fuzzing and program analysis to find and patch bugs in C and Java, processed 54 million lines of code in the final, found 18 real zero-days and patched 43 of 54 synthetic bugs. OpenSSF's OSS-CRS packages them for open-source maintainers.
- [Atlantis](https://agentsast.com/tools/atlantis/): Atlantis won DARPA's AI Cyber Challenge (4 million dollar first prize) with an ensemble of independent LLM and fuzzing modules that share seeds, and found the most real-world bugs in the final.
- [Buttercup](https://agentsast.com/tools/buttercup/): Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.
- [RoboDuck](https://agentsast.com/tools/roboduck/): RoboDuck placed third in AIxCC (1.5 million dollars) with a pipeline that relies on LLM reasoning alone to produce proofs of vulnerability, without fuzzing or symbolic execution.
- [OSS-CRS and other AIxCC finalists](https://agentsast.com/tools/oss-crs/): OSS-CRS is OpenSSF's effort to integrate the open-sourced AIxCC finalist systems, including Shellphish's ARTIPHISHELL, BugBuster, all-you-need-is-a-fuzzing-brain and Lacrosse, so open-source maintainers can run them against OSS-Fuzz projects.

## Smart-contract AI auditors

- [Category guide](https://agentsast.com/categories/smart-contracts/): Commercial and open-source AI auditors for Solidity, Vyper, Rust (Solana), Move and Cairo. Published recall against human audits ranges from about 30 percent (Nethermind AuditAgent on its own audits) to about 70 percent on the EVMbench benchmark; precision on live code is around 55 percent in the one controlled study (Sherlock AI). Several also cover ZK circuit languages.
- [Sherlock AI](https://agentsast.com/tools/sherlock-ai/): Sherlock AI is Sherlock's Solidity auditor. In Sherlock's own controlled benchmark on the Flayer and Moongate codebase, scored by an independent researcher, version 2.2 produced 21 valid findings out of 38 (55 percent precision) against 4 of 8 for GPT-5.2 and 1 of 16 for Claude Sonnet 4.5.
- [AuditAgent](https://agentsast.com/tools/auditagent/): AuditAgent is Nethermind's smart-contract auditing agent. On 29 real Nethermind audits it averaged 30 percent recall (up to 50 percent), catching 42 percent of criticals and 43 percent of highs and finding valid issues in 62 percent of projects; on EVMbench it reported 67 percent post-validation recall against 47 percent for Claude Opus 4.6 and 38 percent for GPT-5.2. It retroactively flagged the ResupplyFi exploit.
- [Zellic V12](https://agentsast.com/tools/zellic-v12/): Zellic V12 is an autonomous Solidity auditor combining LLMs with static analysis. Zellic reported 39 findings across live audits, Cantina contests and a Pendle bug, and a 70.6 percent detect score on EVMbench (March 2026). Its co-founder describes it as matching junior auditors but not top firms.
- [Savant Chat](https://agentsast.com/tools/savant-chat/): Savant Chat is a multi-agent auditor with the broadest language list on this index, including Circom, Halo2, Noir and arkworks alongside Solidity, Rust, Move and Cairo. It placed sixth in Sherlock's Symbiotic contest in September 2025, a contest with no high or critical findings.
- [Olympix](https://agentsast.com/tools/olympix/): Olympix is a commercial CI tool for Solidity that combines an intermediate representation, custom detectors, symbolic execution, fuzzing and mutation testing with AI, producing executable proofs of concept on every commit.
- [Octane Security](https://agentsast.com/tools/octane/): Octane provides continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos, backed by a seed round led by Archetype and Winklevoss Capital.
- [Hound](https://agentsast.com/tools/hound/): Hound is an open-source auditing agent that builds relation-first knowledge graphs of a codebase and maintains persistent vulnerability hypotheses. On a ScaBench subset it reported 34 true positives against 9 for the baseline, with recall of 31.2 percent versus 8.3 percent.
- [QuillShield](https://agentsast.com/tools/quillshield/): QuillShield is QuillAudits' AI auditing product for Solidity, complemented by open-source Claude skills that decompose contract behaviour, model threats and simulate adversaries.
- [Cecuro](https://agentsast.com/tools/cecuro/): Cecuro published a benchmark of 90 contracts exploited between October 2024 and early 2026 (228 million dollars lost) and reports its agent detecting 92 percent of the value at risk against 34 percent for a baseline GPT-5.1 agent. The benchmark and baseline are open; the agent is not.
- [Certora AI Composer](https://agentsast.com/tools/certora-ai-composer/): Certora AI Composer pairs LLM code generation with the Certora Prover so generated Solidity is checked against invariants before it is accepted. It is a secure-generation tool rather than a scanner, and the clearest example of LLM plus formal verification.
- [Immunefi Magnus](https://agentsast.com/tools/immunefi-magnus/): Magnus is Immunefi's security operations platform combining Security Swarm AI agents, Fuzzland's AI fuzzing and the CODEX vulnerability dataset with its bounty infrastructure.

## Benchmarks and research

- [Category guide](https://agentsast.com/categories/benchmarks/): The datasets used to score AI bug finders, and the research systems that established the methods. zkbugs is the only ZK-specific benchmark; EVMbench (OpenAI and Paradigm) is the most cited for Solidity and the most criticised for contamination; CyberGym and BountyBench cover general software. Read the methodology before the headline number.
- [zkbugs](https://agentsast.com/tools/zkbugs/): zkbugs is zkSecurity's benchmark and knowledge base of zero-knowledge circuit vulnerabilities (139 catalogued across ZK DSLs), with reproducible cases used to score zk-skills at 66 of 70 in direct mode and 40 of 56 on full codebases. The companion site bugs.zksecurity.xyz is the public ZK bug tracker.
- [EVMbench](https://agentsast.com/tools/evmbench/): EVMbench contains 117 vulnerabilities from 40 audits with detect, patch and exploit modes; GPT-5.3-Codex scored 72.2 percent in exploit mode against 31.9 percent for GPT-5. OpenZeppelin's audit found at least four invalid high-severity items and training-data contamination risk, and a re-evaluation paper followed.
- [ScaBench and SCONE-bench](https://agentsast.com/tools/scabench/): ScaBench draws ground truth from 31 projects audited on Code4rena, Cantina and Sherlock and is the benchmark behind Hound's published recall; SCONE-bench is Anthropic's smart-contract benchmark.
- [CyberGym, BountyBench and SEC-bench](https://agentsast.com/tools/cybergym/): CyberGym (1,507 instances from 188 projects, with an end-to-end variant), BountyBench (40 offence and defence tasks) and SEC-bench are the main general-software benchmarks for AI vulnerability discovery, and the ones frontier labs cite.
- [GPTScan and PropertyGPT (research)](https://agentsast.com/tools/gptscan-propertygpt/): GPTScan (ICSE 2024) combined GPT with static analysis for Solidity logic bugs, reporting over 90 percent precision on token contracts and 57 percent on large projects with 9 new bugs. PropertyGPT (NDSS 2025) generates formal properties for smart contracts with retrieval augmentation, the ancestor of LLM plus prover tools.

## Firms (in index order)
- [zkSecurity](https://agentsast.com/firms/zksecurity/): Cryptography and ZK audits with AI tooling built in-house: zkao, zk-skills, zkbugs; human validation of every finding
- [Trail of Bits](https://agentsast.com/firms/trail-of-bits/): AI-native security practice: Buttercup, 201 open-source skills, about 20 percent of reported bugs first surfaced by AI, all human-validated
- [Zellic](https://agentsast.com/firms/zellic/): V12 autonomous Solidity auditor alongside human audits; ZK and Rust work
- [Nethermind Security](https://agentsast.com/firms/nethermind-security/): AuditAgent as a second layer after manual audits; published recall data
- [Sherlock](https://agentsast.com/firms/sherlock/): Sherlock AI plus audit contests and private audits
- [Cantina (Spearbit)](https://agentsast.com/firms/cantina/): AI-native AppSec platform with an enterprise AI code analyzer and a 9,000-researcher network
- [Consensys Diligence](https://agentsast.com/firms/consensys-diligence/): Agentic vulnerability mining as a co-audit workflow guided by veteran auditors
- [Cyfrin](https://agentsast.com/firms/cyfrin/): Aderyn static analyzer, Solodit API for AI agents, CodeHawks contests; an AI formal verification engagement for Lido
- [OpenZeppelin](https://agentsast.com/firms/openzeppelin/): AI Auditor within Program Security; audited EVMbench
- [QuillAudits](https://agentsast.com/firms/quillaudits/): QuillShield AI plus human audits across 1,400 projects
- [Certora](https://agentsast.com/firms/certora/): Formal verification core; AI Composer for prover-checked code generation
- [Veridise](https://agentsast.com/firms/veridise/): Formal methods and static analysis for ZK (Picus, ZK Vanguard, LLZK); no public LLM tooling

## Glossary
- [False positive rate](https://agentsast.com/glossary/false-positive-rate/): The share of reported findings that are not real, exploitable bugs. Benchmarks that count only recall against a curated bug list cannot measure it.
- [Precision vs recall](https://agentsast.com/glossary/precision-vs-recall/): Precision is valid findings divided by all findings reported; recall is known bugs found divided by all known bugs. A useful evaluation reports both.
- [Agentic scanning](https://agentsast.com/glossary/agentic-scanning/): An LLM that plans, reads files, runs tools and tests, and iterates over a codebase, instead of answering one prompt over pasted code.
- [LLM plus fuzzing](https://agentsast.com/glossary/llm-plus-fuzzing/): The model proposes harnesses, seeds or mutation patterns; the fuzzer supplies ground truth by crashing or violating an oracle.
- [LLM plus symbolic execution or formal verification](https://agentsast.com/glossary/llm-plus-formal-verification/): The model generates properties, invariants or code; a solver or prover checks them, so the model's output is accepted only when a machine confirms it.
- [Hallucinated vulnerabilities](https://agentsast.com/glossary/hallucinated-vulnerabilities/): Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.
- [Triage burden](https://agentsast.com/glossary/triage-burden/): The human time needed to validate candidate findings. zkSecurity reported more than a thousand candidates across two hundred projects as its main bottleneck; Codex Security reported more than ten thousand high findings in its first month.
- [Benchmark contamination](https://agentsast.com/glossary/benchmark-contamination/): The model has seen the audit report or the bug in training, so a benchmark hit measures recall of memory rather than discovery.
- [Human-in-the-loop](https://agentsast.com/glossary/human-in-the-loop/): A named person validates exploitability, severity and disclosure before a finding is reported to a client or maintainer.
- [AI-assisted audit vs AI audit](https://agentsast.com/glossary/ai-assisted-vs-ai-audit/): An AI-assisted audit is a human-signed report in which AI widened coverage; an AI audit is machine output with no accountable reviewer.
- [Prompt injection in auditing pipelines](https://agentsast.com/glossary/prompt-injection/): Repository contents (commit messages, comments, PR descriptions, issue text) can carry instructions that hijack an agent running with CI privileges.
- [Responsible disclosure of AI-found bugs](https://agentsast.com/glossary/responsible-disclosure-ai/): The same coordinated-disclosure rules as human findings, plus a duty to send only validated, reproducible reports so maintainers are not flooded.
- [Continuous scanning and run-count coverage](https://agentsast.com/glossary/continuous-scanning/): Running AI analysis repeatedly, on every commit and whenever models improve, on the premise that LLM bug finding is non-deterministic and coverage compounds with runs.
- [Proof-of-concept harness](https://agentsast.com/glossary/proof-of-concept-harness/): Tooling that turns a candidate finding into an executable exploit or failing test, such as zkao's cheatVM for Aleo or Codex Security's sandbox.
- [Threat model file](https://agentsast.com/glossary/threat-model-file/): A scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.
- [Severity calibration](https://agentsast.com/glossary/severity-calibration/): Whether the tool's assigned severities match what an expert would assign. In the CIRCL study, four of seven AI severities were too high and one critical was rated medium.

## Other
- [Checklist](https://agentsast.com/checklist/)
- [FAQ](https://agentsast.com/faq/)
- [Timeline](https://agentsast.com/news/)
- [About and methodology](https://agentsast.com/about/)
- [JSON API](https://agentsast.com/api/index.json)

---

# Full text summaries

AI bug-finding tools for cryptographic code and ZK circuits: zkao, zk-skills, zkCraft and others
================================================================================

Tools built for the code that general scanners handle worst: finite-field arithmetic, constraint systems, pairing libraries, MPC and post-quantum implementations. zkao (zkSecurity) is the only product in this class with public, upstream-confirmed critical findings; zk-skills makes the same audit patterns available as open-source agent skills; zkCraft adds LLM guidance to circuit fuzzing.

zkao: zkSecurity — Circom, Leo (Aleo), Rust crypto, Go crypto, MPC, FHE, Post-quantum, TLS / E2EE — Multi-agent LLM workflows with expert-maintained skills, a second wave of validating agents, PoC harnesses, and automatic re-scans as models improve — Active (zkao 2.0 released 2026-07-24)
zk-skills and circom-auditor: zkSecurity — Circom, Claude Code, Codex, Cursor — Agent skills (prompts, workflows and checklists) that turn a general coding agent into a Circom auditor — Active (released 2026-08-05)
zkCraft (with zkFuzz): Academic (Takahashi et al.) — Circom, Noir (preliminary) — LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth — Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)
AI Grinding for cryptanalysis (research): Olejnik and Naskrecki (academic) — Published cryptographic constructions, Cryptanalysis — Autonomous workflow: agents propose low-precision attack hypotheses, an exact, adversarially controlled test provides evidence — Research (2026-08-22)
How to choose: Circom, Leo, Rust or Go cryptographic code with a budget for continuous scanning: **zkao**. | A first pass you can run yourself with Claude Code, Codex or Cursor on Circom: **zk-skills / circom-auditor**. | Automatic, specification-free circuit checks alongside AI: **zkFuzz** with **zkCraft** guidance (and Picus or CIVER, covered on the formal verification side). | Solidity plus Circom, Halo2 or Noir in one product: **Savant Chat** lists all of them; check its ZK results before relying on it. | Whatever tool you run, budget human cryptographer time for validation; every vendor in this category says so.

Source page: https://agentsast.com/categories/crypto-zk/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Frontier-lab AI security scanners: Claude Security, Codex Security, Big Sleep, CodeMender, AISLE, XBOW compared
================================================================================

General-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.

Claude Security: Anthropic — General code, Enterprise repositories, Claude Code plugin — Agentic multi-stage analysis that traces data flows and re-examines findings to filter false positives; findings carry CWE, severity and confidence; produces patch files — Active (public beta May 2026; on Claude Mythos 5 from 2026-08-21)
Codex Security (formerly Aardvark): OpenAI — General code, Commits and pull requests — Builds a project threat model, scans commits, validates exploitability in a sandbox, proposes patches — Active (research preview 2026-03-06)
Big Sleep and CodeMender: Google DeepMind and Project Zero — C / C++ open source, V8, SQLite, FFmpeg — LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data — Active
AISLE: AISLE — C source, OpenSSL, curl — Autonomous analysis of C code with on-premises deployment option — Active
XBOW: XBOW — Web applications, Deployed services — Autonomous black-box penetration testing agent — Active (155 million dollar Series C in 2026)
How to choose: Enterprise repositories on Claude or ChatGPT plans: **Claude Security** or **Codex Security**, priced as token usage or subscription; expect a large volume of findings to triage. | C libraries where memory-safety bugs dominate (TLS stacks, parsers): **AISLE**, or the open-source **AIxCC** systems. | Web application penetration testing rather than code review: **XBOW**. | Cryptographic protocol logic: none of these. Pair with a cryptography-specific tool and human cryptographers.

Source page: https://agentsast.com/categories/frontier/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

DARPA AIxCC cyber reasoning systems: Atlantis, Buttercup, RoboDuck, ARTIPHISHELL, open-sourced 2025
================================================================================

The seven finalists of DARPA's AI Cyber Challenge, all open-sourced after the August 2025 final. They combine LLMs with fuzzing and program analysis to find and patch bugs in C and Java, processed 54 million lines of code in the final, found 18 real zero-days and patched 43 of 54 synthetic bugs. OpenSSF's OSS-CRS packages them for open-source maintainers.

Atlantis: Team Atlanta (Georgia Tech, Samsung Research, KAIST, POSTECH) — C, Java — Ensemble of independent bug-finding modules sharing seeds, with eight patching agents — Open-sourced after the 2025-08-08 final
Buttercup: Trail of Bits — C, Java — LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches — Open-sourced 2025
RoboDuck: Theori — C, Java — LLM-only pipeline with no fuzzing or symbolic execution — Open-sourced 2025
OSS-CRS and other AIxCC finalists: OpenSSF and the AIxCC finalist teams — C, Java, OSS-Fuzz projects — Packaging of finalist components (Shellphish ARTIPHISHELL, 42-b3yond-6ug BugBuster, all-you-need-is-a-fuzzing-brain, Lacrosse) for open-source maintainers — Active
How to choose: Cheapest self-hosted starting point: **Buttercup** (Trail of Bits). | Highest real-world bug count in the final: **Atlantis** (Team Atlanta). | Study of what LLMs alone can do without fuzzing: **RoboDuck** (Theori). | Integrated distribution for maintainers: OpenSSF **OSS-CRS**.

Source page: https://agentsast.com/categories/aixcc/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AI smart-contract auditing tools: Sherlock AI, AuditAgent, Zellic V12, Savant Chat, Olympix, Octane, Hound compared
================================================================================

Commercial and open-source AI auditors for Solidity, Vyper, Rust (Solana), Move and Cairo. Published recall against human audits ranges from about 30 percent (Nethermind AuditAgent on its own audits) to about 70 percent on the EVMbench benchmark; precision on live code is around 55 percent in the one controlled study (Sherlock AI). Several also cover ZK circuit languages.

Sherlock AI: Sherlock — Solidity, EVM — Multi-step LLM reasoning trained on top researchers' findings; GitHub PR integration; codebase chat; verification tests for fixes — Active (v2 May 2026)
AuditAgent: Nethermind Security — EVM, Solana, Starknet — LLM agent run after manual review as a second layer — Active
Zellic V12: Zellic — Solidity — LLM combined with static analysis, aimed at the roughly 70 percent of bugs that are coding mistakes — Active (announced 2025-09-25)
Savant Chat: Novel Codes DMCC — Solidity, Vyper, Rust, Move, Cairo, FunC, Circom, Halo2, Noir, arkworks — Multi-agent LLM stack across 200+ vulnerability classes; critic subagent writes a PoC per finding on higher tiers — Active
Olympix: Olympix — Solidity — IR and custom detectors, symbolic execution, fuzzing, mutation testing plus AI, with executable PoCs, run per commit — Active (founded 2022)
Octane Security: Octane — EVM, Solana, Aptos, Sui, Cosmos — Continuous AI scanning with automated fixes — Active (6.75 million dollar seed)
Hound: Bernhard Mueller (scabench-org) — Language-agnostic, Solidity — Relation-first knowledge graphs, persistent vulnerability hypotheses, scout and strategist model switching — Active (paper 2025-10)
QuillShield: QuillAudits — Solidity — AI audits plus open-source Claude skills using a 'Semantic State Protocol' (behavioral decomposition, threat modeling, adversarial simulation, risk scoring) — Active
Cecuro: Cecuro — DeFi contracts — Specialised agent; benchmark and baseline open-sourced, agent withheld — Active
Certora AI Composer: Certora — Solidity — Secure generation: model writes code, the formal prover checks invariants before acceptance — Alpha
Immunefi Magnus: Immunefi — Smart contracts, Bounty programs — Security Swarm agents, Fuzzland AI fuzzing integration, CODEX vulnerability dataset — Active
How to choose: Published recall on real audits and EVMbench: **AuditAgent** (Nethermind). | Controlled precision study and PR-integrated workflow: **Sherlock AI**. | Static-analysis hybrid from a top audit firm: **Zellic V12**. | Per-commit CI with executable proofs of concept: **Olympix**, **Octane**. | Open source and language-agnostic: **Hound**. | Solidity plus ZK circuit languages in one product: **Savant Chat**.

Source page: https://agentsast.com/categories/smart-contracts/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Benchmarks for AI security tools: zkbugs, EVMbench, ScaBench, SCONE-bench, CyberGym, BountyBench and key papers
================================================================================

The datasets used to score AI bug finders, and the research systems that established the methods. zkbugs is the only ZK-specific benchmark; EVMbench (OpenAI and Paradigm) is the most cited for Solidity and the most criticised for contamination; CyberGym and BountyBench cover general software. Read the methodology before the headline number.

zkbugs: zkSecurity — Circom, ZK DSLs, 139 catalogued vulnerabilities — Reproducible vulnerable circuits with direct and full-codebase evaluation modes; public knowledge base at bugs.zksecurity.xyz — Active
EVMbench: OpenAI and Paradigm — Solidity, 117 vulnerabilities from 40 audits — Detect, patch and exploit modes — Active (released 2026-02-18)
ScaBench and SCONE-bench: scabench-org; Anthropic — Solidity, 31 projects from Code4rena, Cantina, Sherlock — Ground truth from public contest findings; SCONE-bench from Anthropic — Active
CyberGym, BountyBench and SEC-bench: Academic — General software, 1,507 CyberGym instances from 188 projects, 40 BountyBench tasks — Reproduce real vulnerabilities from crash inputs (CyberGym), offence and defence bounty tasks (BountyBench), end-to-end PoC generation (SEC-bench) — Active
GPTScan and PropertyGPT (research): Academic — Solidity — GPTScan: GPT plus static analysis for logic bugs (ICSE 2024); PropertyGPT: retrieval-augmented generation of formal properties (NDSS 2025) — Published
How to choose: ZK circuit tools: score on **zkbugs** in both direct and full-codebase modes and report both. | Solidity tools: use **EVMbench** with OpenZeppelin's corrections, and **ScaBench** for contest-derived ground truth. | General code: **CyberGym**, **BountyBench**, **SEC-bench**. | Any vendor number: ask for the dataset, the cutoff date, precision and the full findings list.

Source page: https://agentsast.com/categories/benchmarks/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

zkao (zkSecurity): AI bug detection for cryptography code and ZK circuits, results, pricing and how it works
================================================================================

zkao is zkSecurity's AI-powered continuous security scanner for cryptography code: ZK circuits, MPC protocols, FHE schemes, end-to-end encryption, TLS stacks and post-quantum primitives. It connects to a GitHub repository, runs multi-agent analysis built from zkSecurity's audit patterns, validates findings with a second wave of agents and re-runs scans as models improve. Its public results in 2026 include seven confirmed bugs in Cloudflare's CIRCL library, the critical OpenVM zkVM soundness bug CVE-2026-46669, and four zero-days in Bron Labs' bron-crypto, all fixed upstream.

Maintainer: zkSecurity
Website: https://zkao.io
Category: Cryptography and ZK specialists
Targets: Circom, Leo (Aleo), Rust crypto, Go crypto, MPC, FHE, Post-quantum, TLS / E2EE
Approach: Multi-agent LLM workflows with expert-maintained skills, a second wave of validating agents, PoC harnesses, and automatic re-scans as models improve
Access: SaaS; prepaid non-expiring credits; enterprise plans with human audits
Status: Active (zkao 2.0 released 2026-07-24)
Strengths: Only AI tool with public, upstream-confirmed critical findings in cryptographic libraries and a zkVM. | Built and validated by a cryptography audit firm; skills encode real audit patterns and a threat-model file measurably reduces false positives. | Continuous model: prepaid credits, deduplicated re-scans, and an enterprise path to human audits from the same team.
Limits: Candidates, not reports: zkSecurity's own posts document mis-rated severities and triage of more than a thousand candidates as the main bottleneck. | Language coverage is cryptography-first (Circom, Leo, Rust, Go); Solidity and EVM are out of scope. | Curated sign-in and no free tier; underlying models are not disclosed on the product pages.
Firms using it: zkSecurity
Sources: https://zkao.io | https://zkao.io/how-it-works | https://zkao.io/continuous-security | https://zkao.io/pricing | https://blog.zksecurity.xyz/posts/zkao-launch/ | https://blog.zksecurity.xyz/posts/zkao-2-0/ | https://blog.zksecurity.xyz/posts/circl-bugs/ | https://blog.zksecurity.xyz/posts/openvm-bugs/ | https://blog.zksecurity.xyz/posts/bron-bugs/ | https://blog.zksecurity.xyz/posts/zkao-aleo-integration/

Source page: https://agentsast.com/tools/zkao/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

zk-skills and circom-auditor: Open-source security skills for coding agents, scoring 66 of 70 on zkbugs
================================================================================

zk-skills is zkSecurity's open-source set of security skills for Claude Code, Codex and Cursor. Its circom-auditor skill scores 66 of 70 known bugs with Claude Opus 4.8 and 64 of 70 with GPT-5.5 on the zkbugs benchmark in direct mode, and 40 of 56 and 14 of 56 on full original codebases, against 30 of 70 and 8 of 56 for the Ecne tool. It is positioned as a pre-audit first pass, with zkao as the continuous deep option.

Maintainer: zkSecurity
Website: https://github.com/zksecurity/zk-skills
Category: Cryptography and ZK specialists
Targets: Circom, Claude Code, Codex, Cursor
Approach: Agent skills (prompts, workflows and checklists) that turn a general coding agent into a Circom auditor
Access: Open source (MIT)
Status: Active (released 2026-08-05)
Strengths: Free, open and runnable today with the agent you already use. | Benchmarked publicly in both easy and hard modes. | Maintained by a firm that audits Circom for a living.
Limits: Circom only at release. | Depends on the underlying model and your agent setup; results vary run to run. | No validation layer; you triage everything.
Firms using it: zkSecurity
Sources: https://github.com/zksecurity/zk-skills | https://blog.zksecurity.xyz/posts/circom-auditor/

Source page: https://agentsast.com/tools/zk-skills/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

zkCraft (with zkFuzz): Prompt-guided LLM mutation oracle on top of the zkFuzz circuit fuzzer
================================================================================

zkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.

Maintainer: Academic (Takahashi et al.)
Website: https://arxiv.org/abs/2602.00667
Category: Cryptography and ZK specialists
Targets: Circom, Noir (preliminary)
Approach: LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth
Access: Open source
Status: Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)
Strengths: Ground truth from execution, so no hallucinated findings. | Strong published bug counts. | Open source.
Limits: Circom focus; Noir preliminary. | Cannot prove absence of bugs. | Research maintenance cadence.
Firms using it: none listed
Sources: https://arxiv.org/abs/2602.00667 | https://arxiv.org/abs/2504.11961 | https://github.com/Koukyosyumei/zkFuzz

Source page: https://agentsast.com/tools/zkcraft/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AI Grinding for cryptanalysis (research): Agents generate high-volume hypotheses; exact adversarial tests decide
================================================================================

A 2026 paper describing an autonomous cryptanalysis workflow in which agents produce many low-precision hypotheses and an exact, adversarially controlled test decides which count as evidence. It claims reproducible failures in eight published constructions and is the reference for applying the candidate-plus-oracle pattern to cryptography itself rather than code.

Maintainer: Olejnik and Naskrecki (academic)
Website: https://arxiv.org/abs/2608.21986
Category: Cryptography and ZK specialists
Targets: Published cryptographic constructions, Cryptanalysis
Approach: Autonomous workflow: agents propose low-precision attack hypotheses, an exact, adversarially controlled test provides evidence
Access: Research paper
Status: Research (2026-08-22)
Strengths: Exact tests remove hallucination. | Targets design-level flaws.
Limits: Not a product. | Requires building the exact test per construction. | Claims await independent reproduction.
Firms using it: none listed
Sources: https://arxiv.org/abs/2608.21986 | https://blog.zksecurity.xyz/posts/llms-in-research/

Source page: https://agentsast.com/tools/ai-grinding-cryptanalysis/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Claude Security: Anthropic's agentic vulnerability scanner, enterprise availability on Mythos-class models
================================================================================

Claude Security is Anthropic's vulnerability scanner, launched as Claude Code Security in a February 2026 research preview, opened to enterprises in May 2026 with a reported 2,100 vulnerabilities patched in three weeks, shipped as a Claude Code plugin in July 2026, and running on Claude Mythos 5 for enterprise customers from 21 August 2026. Anthropic's Project Glasswing partners reported more than 10,000 high or critical findings by May 2026, including the wolfSSL certificate-forgery CVE-2026-5194.

Maintainer: Anthropic
Website: https://anthropic.com/news/claude-code-security
Category: Frontier-lab and general scanners
Targets: General code, Enterprise repositories, Claude Code plugin
Approach: Agentic multi-stage analysis that traces data flows and re-examines findings to filter false positives; findings carry CWE, severity and confidence; produces patch files
Access: Enterprise SaaS, billed as token usage
Status: Active (public beta May 2026; on Claude Mythos 5 from 2026-08-21)
Strengths: Scale of deployment and results. | Integrated with Claude Code; emits patches. | Confidence and CWE on every finding aid triage.
Limits: Not cryptography-aware; protocol and constraint bugs need domain skills or a specialist tool. | Volume of findings creates triage burden. | Enterprise plans only; model versions change under you.
Firms using it: none listed
Sources: https://anthropic.com/news/claude-code-security | https://www.anthropic.com/research/glasswing-initial-update | https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders

Source page: https://agentsast.com/tools/claude-security/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Codex Security (formerly Aardvark): OpenAI's agentic scanner with sandboxed exploit validation
================================================================================

Codex Security is OpenAI's agentic security scanner, announced as Aardvark in October 2025 with a claimed 92 percent detection rate on benchmark repositories and released as a research preview in March 2026. In its first thirty days it scanned 1.2 million commits, reported 792 critical and 10,561 high findings and 14 CVEs including OpenSSH, GnuTLS and Chromium, and claimed up to 84 percent noise reduction through sandboxed validation.

Maintainer: OpenAI
Website: https://openai.com/index/codex-security-now-in-research-preview/
Category: Frontier-lab and general scanners
Targets: General code, Commits and pull requests
Approach: Builds a project threat model, scans commits, validates exploitability in a sandbox, proposes patches
Access: SaaS for ChatGPT Pro, Business, Enterprise and Edu
Status: Active (research preview 2026-03-06)
Strengths: Exploit validation before reporting. | CVEs in cryptographic and network libraries (OpenSSH, GnuTLS). | Threat-model construction per project.
Limits: Not cryptography-aware. | Findings volume. | Benchmark claims lack a public dataset.
Firms using it: none listed
Sources: https://openai.com/index/introducing-aardvark/ | https://openai.com/index/codex-security-now-in-research-preview/

Source page: https://agentsast.com/tools/codex-security/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Big Sleep and CodeMender: Google's LLM bug hunter and its patching companion
============================================================================

Big Sleep is Google's LLM-based bug hunter, credited with 20 flaws in FFmpeg and ImageMagick in August 2025 and with catching SQLite CVE-2025-6965 before exploitation. CodeMender (preview) validates and patches, and Gemini 3.5 Flash Cyber (July 2026) found 55 confirmed V8 issues. None is sold as a product to the public.

Maintainer: Google DeepMind and Project Zero
Website: https://blog.google/innovation-and-ai/technology/safety-security/cybersecurity-updates-summer-2025/
Category: Frontier-lab and general scanners
Targets: C / C++ open source, V8, SQLite, FFmpeg
Approach: LLM agent evolved from Project Naptime; CodeMender validates with sandboxed PoCs and patches with a model-as-judge; Gemini 3.5 Flash Cyber trained on OSV and OSS-Fuzz data
Access: Big Sleep internal; CodeMender preview on Google Cloud; Flash Cyber gated to governments and partners
Status: Active
Strengths: Pre-exploitation catch in SQLite. | Rigorous Project Zero disclosure. | CodeMender closes the loop to patches.
Limits: Not available as a service. | C and C++ focus. | Not cryptography-aware.
Firms using it: none listed
Sources: https://blog.google/innovation-and-ai/technology/safety-security/cybersecurity-updates-summer-2025/ | https://cloud.google.com/security/codemender | https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/

Source page: https://agentsast.com/tools/big-sleep/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AISLE: Autonomous C analyzer credited with 12 of 12 OpenSSL CVEs in one release
===============================================================================

AISLE is an autonomous analyzer for C source code credited with all twelve CVEs in OpenSSL's 27 January 2026 release (three dating to 1998 to 2000), twenty OpenSSL zero-days in six months, and six low-severity curl CVEs in August 2026 after curl's maintainer noted that Mythos and Codex Security had reported none.

Maintainer: AISLE
Website: https://aisle.com
Category: Frontier-lab and general scanners
Targets: C source, OpenSSL, curl
Approach: Autonomous analysis of C code with on-premises deployment option
Access: Enterprise
Status: Active
Strengths: Unmatched OpenSSL result count. | On-prem option for sensitive code. | Focused product.
Limits: C only. | Implementation bugs, not protocol logic. | Enterprise pricing; limited public methodology.
Firms using it: none listed
Sources: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities | https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero

Source page: https://agentsast.com/tools/aisle/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

XBOW: Autonomous web penetration testing, top of HackerOne's US leaderboard
===========================================================================

XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.

Maintainer: XBOW
Website: https://xbow.com
Category: Frontier-lab and general scanners
Targets: Web applications, Deployed services
Approach: Autonomous black-box penetration testing agent
Access: SaaS
Status: Active (155 million dollar Series C in 2026)
Strengths: Proven against real bounty programs. | No source access required.
Limits: Black-box web only. | Not a code auditor.
Firms using it: none listed
Sources: https://xbow.com

Source page: https://agentsast.com/tools/xbow/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Atlantis: AIxCC winner from Team Atlanta
========================================

Atlantis won DARPA's AI Cyber Challenge (4 million dollar first prize) with an ensemble of independent LLM and fuzzing modules that share seeds, and found the most real-world bugs in the final.

Maintainer: Team Atlanta (Georgia Tech, Samsung Research, KAIST, POSTECH)
Website: https://team-atlanta.github.io/
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: C, Java
Approach: Ensemble of independent bug-finding modules sharing seeds, with eight patching agents
Access: Open source
Status: Open-sourced after the 2025-08-08 final
Strengths: Best real-bug count in a controlled competition. | Open source.
Limits: Heavy to deploy. | C and Java only. | Research code quality.
Firms using it: none listed
Sources: https://team-atlanta.github.io/ | https://www.darpa.mil/news/2025/aixcc-results

Source page: https://agentsast.com/tools/atlantis/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Buttercup: Trail of Bits' laptop-runnable cyber reasoning system, AIxCC second place
================================================================================

Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.

Maintainer: Trail of Bits
Website: https://github.com/trailofbits/buttercup
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: C, Java
Approach: LLM plus fuzzing plus program analysis using non-reasoning models; finds and patches
Access: Open source
Status: Open-sourced 2025
Strengths: Cheap and self-hostable. | High accuracy in the final. | Maintained by an audit firm.
Limits: C and Java. | Fuzzing-dependent: needs harnesses. | Not cryptography-aware.
Firms using it: Trail of Bits
Sources: https://github.com/trailofbits/buttercup

Source page: https://agentsast.com/tools/buttercup/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

RoboDuck: Theori's LLM-only proof-of-vulnerability pipeline, AIxCC third place
==============================================================================

RoboDuck placed third in AIxCC (1.5 million dollars) with a pipeline that relies on LLM reasoning alone to produce proofs of vulnerability, without fuzzing or symbolic execution.

Maintainer: Theori
Website: https://theori.io
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: C, Java
Approach: LLM-only pipeline with no fuzzing or symbolic execution
Access: Open source
Status: Open-sourced 2025
Strengths: Simple architecture. | Competitive result without fuzzing.
Limits: No execution ground truth. | C and Java.
Firms using it: none listed
Sources: https://www.darpa.mil/news/2025/aixcc-results | https://arxiv.org/abs/2602.07666

Source page: https://agentsast.com/tools/roboduck/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

OSS-CRS and other AIxCC finalists: OpenSSF's integrated distribution of ARTIPHISHELL, BugBuster, Lacrosse and others
================================================================================

OSS-CRS is OpenSSF's effort to integrate the open-sourced AIxCC finalist systems, including Shellphish's ARTIPHISHELL, BugBuster, all-you-need-is-a-fuzzing-brain and Lacrosse, so open-source maintainers can run them against OSS-Fuzz projects.

Maintainer: OpenSSF and the AIxCC finalist teams
Website: https://arxiv.org/abs/2602.07666
Category: Cyber reasoning systems (DARPA AIxCC)
Targets: C, Java, OSS-Fuzz projects
Approach: Packaging of finalist components (Shellphish ARTIPHISHELL, 42-b3yond-6ug BugBuster, all-you-need-is-a-fuzzing-brain, Lacrosse) for open-source maintainers
Access: Open source
Status: Active
Strengths: Maintainer-oriented packaging. | Multiple systems in one.
Limits: Early integration. | Requires OSS-Fuzz style harnesses.
Firms using it: none listed
Sources: https://arxiv.org/abs/2602.07666

Source page: https://agentsast.com/tools/oss-crs/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Sherlock AI: Solidity auditor with a controlled precision study
===============================================================

Sherlock AI is Sherlock's Solidity auditor. In Sherlock's own controlled benchmark on the Flayer and Moongate codebase, scored by an independent researcher, version 2.2 produced 21 valid findings out of 38 (55 percent precision) against 4 of 8 for GPT-5.2 and 1 of 16 for Claude Sonnet 4.5.

Maintainer: Sherlock
Website: https://sherlock.xyz/solutions/ai
Category: Smart-contract AI auditors
Targets: Solidity, EVM
Approach: Multi-step LLM reasoning trained on top researchers' findings; GitHub PR integration; codebase chat; verification tests for fixes
Access: Commercial (contact sales)
Status: Active (v2 May 2026)
Strengths: Published precision. | PR-native workflow. | Backed by a contest platform with human researchers.
Limits: Solidity only. | Vendor-run benchmark. | Pricing not public.
Firms using it: Sherlock
Sources: https://sherlock.xyz/solutions/ai | https://sherlock.xyz/post/controlled-benchmark-chatgpt-and-claude-vs-sherlock-ai

Source page: https://agentsast.com/tools/sherlock-ai/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AuditAgent: Nethermind's pair auditor with published recall on real audits
==========================================================================

AuditAgent is Nethermind's smart-contract auditing agent. On 29 real Nethermind audits it averaged 30 percent recall (up to 50 percent), catching 42 percent of criticals and 43 percent of highs and finding valid issues in 62 percent of projects; on EVMbench it reported 67 percent post-validation recall against 47 percent for Claude Opus 4.6 and 38 percent for GPT-5.2. It retroactively flagged the ResupplyFi exploit.

Maintainer: Nethermind Security
Website: https://auditagent.nethermind.io
Category: Smart-contract AI auditors
Targets: EVM, Solana, Starknet
Approach: LLM agent run after manual review as a second layer
Access: SaaS
Status: Active
Strengths: Honest, published recall on real engagements. | Multi-chain. | Positioned correctly as a second layer.
Limits: 30 percent average recall. | Post-validation numbers depend on human triage. | Not for circuits.
Firms using it: Nethermind Security
Sources: https://www.nethermind.io/blog/how-nethermind-security-uses-auditagent-alongside-manual-audits | https://www.nethermind.io/blog/auditagent-on-evmbench-what-the-data-shows

Source page: https://agentsast.com/tools/auditagent/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Zellic V12: LLM plus static analysis for the coding-mistake majority of Solidity bugs
================================================================================

Zellic V12 is an autonomous Solidity auditor combining LLMs with static analysis. Zellic reported 39 findings across live audits, Cantina contests and a Pendle bug, and a 70.6 percent detect score on EVMbench (March 2026). Its co-founder describes it as matching junior auditors but not top firms.

Maintainer: Zellic
Website: https://www.zellic.io/blog/introducing-v12/
Category: Smart-contract AI auditors
Targets: Solidity
Approach: LLM combined with static analysis, aimed at the roughly 70 percent of bugs that are coding mistakes
Access: Announced as free; current availability and pricing not confirmed
Status: Active (announced 2025-09-25)
Strengths: High EVMbench detect score. | Real findings in contests. | Built by a top audit firm.
Limits: Solidity only. | Availability unclear. | EVMbench contamination caveats apply.
Firms using it: Zellic
Sources: https://www.zellic.io/blog/introducing-v12/

Source page: https://agentsast.com/tools/zellic-v12/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Savant Chat: Multi-agent auditor covering Solidity, Rust, Move, Cairo and ZK circuit languages
================================================================================

Savant Chat is a multi-agent auditor with the broadest language list on this index, including Circom, Halo2, Noir and arkworks alongside Solidity, Rust, Move and Cairo. It placed sixth in Sherlock's Symbiotic contest in September 2025, a contest with no high or critical findings.

Maintainer: Novel Codes DMCC
Website: https://savant.chat
Category: Smart-contract AI auditors
Targets: Solidity, Vyper, Rust, Move, Cairo, FunC, Circom, Halo2, Noir, arkworks
Approach: Multi-agent LLM stack across 200+ vulnerability classes; critic subagent writes a PoC per finding on higher tiers
Access: Pay per line (0.07 to 0.50 dollars) or 250 to 2,500 dollars per month; 75 dollars free credits
Status: Active
Strengths: Broadest coverage. | Transparent pricing and a free tier. | PoC per finding on higher tiers.
Limits: No public ZK results. | Contest result is modest. | Per-line pricing scales with codebase.
Firms using it: none listed
Sources: https://savant.chat | https://www.globenewswire.com/news-release/2025/09/02/3143051/0/en/Savant-Chat-achieves-a-historic-top-6-ranking-in-the-Sherlock-DeFi-Audit-Contest.html

Source page: https://agentsast.com/tools/savant-chat/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Olympix: Per-commit Solidity security with symbolic execution, fuzzing, mutation testing and AI
================================================================================

Olympix is a commercial CI tool for Solidity that combines an intermediate representation, custom detectors, symbolic execution, fuzzing and mutation testing with AI, producing executable proofs of concept on every commit.

Maintainer: Olympix
Website: https://olympix.security
Category: Smart-contract AI auditors
Targets: Solidity
Approach: IR and custom detectors, symbolic execution, fuzzing, mutation testing plus AI, with executable PoCs, run per commit
Access: Commercial CI tool
Status: Active (founded 2022)
Strengths: Executable PoCs. | Per-commit. | Multiple analysis engines.
Limits: Solidity only. | Commercial, limited public benchmarks.
Firms using it: none listed
Sources: https://olympix.security

Source page: https://agentsast.com/tools/olympix/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Octane Security: Continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos
================================================================================

Octane provides continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos, backed by a seed round led by Archetype and Winklevoss Capital.

Maintainer: Octane
Website: https://www.octane.security
Category: Smart-contract AI auditors
Targets: EVM, Solana, Aptos, Sui, Cosmos
Approach: Continuous AI scanning with automated fixes
Access: Commercial
Status: Active (6.75 million dollar seed)
Strengths: Multi-chain. | Fix generation.
Limits: Limited public benchmarks. | Not for circuits.
Firms using it: none listed
Sources: https://www.octane.security

Source page: https://agentsast.com/tools/octane/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Hound: Open-source, language-agnostic auditing agent with relation-first knowledge graphs
================================================================================

Hound is an open-source auditing agent that builds relation-first knowledge graphs of a codebase and maintains persistent vulnerability hypotheses. On a ScaBench subset it reported 34 true positives against 9 for the baseline, with recall of 31.2 percent versus 8.3 percent.

Maintainer: Bernhard Mueller (scabench-org)
Website: https://github.com/scabench-org/hound
Category: Smart-contract AI auditors
Targets: Language-agnostic, Solidity
Approach: Relation-first knowledge graphs, persistent vulnerability hypotheses, scout and strategist model switching
Access: Open source
Status: Active (paper 2025-10)
Strengths: Open source with a public benchmark. | Language-agnostic design. | Documented architecture.
Limits: 31 percent recall. | Single-maintainer project.
Firms using it: none listed
Sources: https://github.com/scabench-org/hound | https://arxiv.org/abs/2510.09633

Source page: https://agentsast.com/tools/hound/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

QuillShield: QuillAudits' AI auditor and open-source Claude skills
==================================================================

QuillShield is QuillAudits' AI auditing product for Solidity, complemented by open-source Claude skills that decompose contract behaviour, model threats and simulate adversaries.

Maintainer: QuillAudits
Website: https://shield.quillai.network
Category: Smart-contract AI auditors
Targets: Solidity
Approach: AI audits plus open-source Claude skills using a 'Semantic State Protocol' (behavioral decomposition, threat modeling, adversarial simulation, risk scoring)
Access: Commercial; skills open source
Status: Active
Strengths: Open skills. | Backed by a human audit firm.
Limits: Solidity only. | Limited public benchmarks.
Firms using it: QuillAudits
Sources: https://shield.quillai.network | https://www.quillaudits.com/blog/ai-agents/first-version-claude-skills

Source page: https://agentsast.com/tools/quillshield/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Cecuro: DeFi exploit-detection agent with an open benchmark of 90 exploited contracts
================================================================================

Cecuro published a benchmark of 90 contracts exploited between October 2024 and early 2026 (228 million dollars lost) and reports its agent detecting 92 percent of the value at risk against 34 percent for a baseline GPT-5.1 agent. The benchmark and baseline are open; the agent is not.

Maintainer: Cecuro
Website: https://cecuro.ai/blog/97m-defi-exploits-preventable-specialized-ai
Category: Smart-contract AI auditors
Targets: DeFi contracts
Approach: Specialised agent; benchmark and baseline open-sourced, agent withheld
Access: Commercial
Status: Active
Strengths: Open benchmark. | Loss-weighted scoring.
Limits: Retrospective and contamination-prone. | Closed agent.
Firms using it: none listed
Sources: https://cecuro.ai/blog/97m-defi-exploits-preventable-specialized-ai

Source page: https://agentsast.com/tools/cecuro/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Certora AI Composer: LLM code generation with the Certora Prover checking invariants in the loop
================================================================================

Certora AI Composer pairs LLM code generation with the Certora Prover so generated Solidity is checked against invariants before it is accepted. It is a secure-generation tool rather than a scanner, and the clearest example of LLM plus formal verification.

Maintainer: Certora
Website: https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform
Category: Smart-contract AI auditors
Targets: Solidity
Approach: Secure generation: model writes code, the formal prover checks invariants before acceptance
Access: Open source alpha (2025-12-04)
Status: Alpha
Strengths: Proof-checked output. | Open source.
Limits: Alpha. | Generation, not auditing. | Invariants must be written.
Firms using it: Certora
Sources: https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform

Source page: https://agentsast.com/tools/certora-ai-composer/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Immunefi Magnus: SecOps platform with AI security swarm and AI fuzzing
======================================================================

Magnus is Immunefi's security operations platform combining Security Swarm AI agents, Fuzzland's AI fuzzing and the CODEX vulnerability dataset with its bounty infrastructure.

Maintainer: Immunefi
Website: https://immunefi.com/blog/magnus/introducing-magnus/
Category: Smart-contract AI auditors
Targets: Smart contracts, Bounty programs
Approach: Security Swarm agents, Fuzzland AI fuzzing integration, CODEX vulnerability dataset
Access: Commercial platform
Status: Active
Strengths: Bounty integration. | Large vulnerability dataset.
Limits: Platform, not a standalone scanner. | Public accuracy data limited.
Firms using it: none listed
Sources: https://immunefi.com/blog/magnus/introducing-magnus/

Source page: https://agentsast.com/tools/immunefi-magnus/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

zkbugs: The ZK-specific vulnerability benchmark and knowledge base
==================================================================

zkbugs is zkSecurity's benchmark and knowledge base of zero-knowledge circuit vulnerabilities (139 catalogued across ZK DSLs), with reproducible cases used to score zk-skills at 66 of 70 in direct mode and 40 of 56 on full codebases. The companion site bugs.zksecurity.xyz is the public ZK bug tracker.

Maintainer: zkSecurity
Website: https://github.com/zksecurity/zkbugs
Category: Benchmarks and research
Targets: Circom, ZK DSLs, 139 catalogued vulnerabilities
Approach: Reproducible vulnerable circuits with direct and full-codebase evaluation modes; public knowledge base at bugs.zksecurity.xyz
Access: Open source
Status: Active
Strengths: Only ZK benchmark. | Two difficulty modes. | Public knowledge base.
Limits: Circom-heavy. | Known bugs may be in training data.
Firms using it: zkSecurity
Sources: https://github.com/zksecurity/zkbugs | https://bugs.zksecurity.xyz | https://blog.zksecurity.xyz/posts/zkbugs-website/

Source page: https://agentsast.com/tools/zkbugs/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

EVMbench: OpenAI and Paradigm's Solidity benchmark, with OpenZeppelin's corrections
================================================================================

EVMbench contains 117 vulnerabilities from 40 audits with detect, patch and exploit modes; GPT-5.3-Codex scored 72.2 percent in exploit mode against 31.9 percent for GPT-5. OpenZeppelin's audit found at least four invalid high-severity items and training-data contamination risk, and a re-evaluation paper followed.

Maintainer: OpenAI and Paradigm
Website: https://github.com/paradigmxyz/evmbench
Category: Benchmarks and research
Targets: Solidity, 117 vulnerabilities from 40 audits
Approach: Detect, patch and exploit modes
Access: Open source
Status: Active (released 2026-02-18)
Strengths: Three task modes. | Widely reported scores.
Limits: Contamination risk. | Invalid items identified by OpenZeppelin. | Recall-only scoring hides false positives.
Firms using it: OpenZeppelin
Sources: https://github.com/paradigmxyz/evmbench | https://openai.com/index/introducing-evmbench/ | https://www.openzeppelin.com/news/openai-evmbench-audit | https://arxiv.org/abs/2603.10795

Source page: https://agentsast.com/tools/evmbench/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

ScaBench and SCONE-bench: Contest-derived and Anthropic smart-contract benchmarks
================================================================================

ScaBench draws ground truth from 31 projects audited on Code4rena, Cantina and Sherlock and is the benchmark behind Hound's published recall; SCONE-bench is Anthropic's smart-contract benchmark.

Maintainer: scabench-org; Anthropic
Website: https://github.com/scabench-org/scabench
Category: Benchmarks and research
Targets: Solidity, 31 projects from Code4rena, Cantina, Sherlock
Approach: Ground truth from public contest findings; SCONE-bench from Anthropic
Access: Open source
Status: Active
Strengths: Realistic ground truth. | Open.
Limits: Public findings are in training data. | Solidity only.
Firms using it: none listed
Sources: https://github.com/scabench-org/scabench | https://github.com/anthropics/scone-bench

Source page: https://agentsast.com/tools/scabench/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

CyberGym, BountyBench and SEC-bench: General-software benchmarks for AI vulnerability discovery
================================================================================

CyberGym (1,507 instances from 188 projects, with an end-to-end variant), BountyBench (40 offence and defence tasks) and SEC-bench are the main general-software benchmarks for AI vulnerability discovery, and the ones frontier labs cite.

Maintainer: Academic
Website: https://arxiv.org/abs/2506.02548
Category: Benchmarks and research
Targets: General software, 1,507 CyberGym instances from 188 projects, 40 BountyBench tasks
Approach: Reproduce real vulnerabilities from crash inputs (CyberGym), offence and defence bounty tasks (BountyBench), end-to-end PoC generation (SEC-bench)
Access: Open source
Status: Active
Strengths: Large, reproducible. | Execution-based scoring.
Limits: General code, not cryptographic logic. | Rapid saturation by new models.
Firms using it: none listed
Sources: https://arxiv.org/abs/2506.02548 | https://arxiv.org/html/2606.04460 | https://arxiv.org/abs/2505.15216 | https://arxiv.org/abs/2506.11791

Source page: https://agentsast.com/tools/cybergym/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

GPTScan and PropertyGPT (research): The papers that established LLM plus static analysis and LLM plus formal verification
================================================================================

GPTScan (ICSE 2024) combined GPT with static analysis for Solidity logic bugs, reporting over 90 percent precision on token contracts and 57 percent on large projects with 9 new bugs. PropertyGPT (NDSS 2025) generates formal properties for smart contracts with retrieval augmentation, the ancestor of LLM plus prover tools.

Maintainer: Academic
Website: https://arxiv.org/abs/2308.03314
Category: Benchmarks and research
Targets: Solidity
Approach: GPTScan: GPT plus static analysis for logic bugs (ICSE 2024); PropertyGPT: retrieval-augmented generation of formal properties (NDSS 2025)
Access: Research
Status: Published
Strengths: Peer reviewed. | Clear methodology.
Limits: Older models. | Research code.
Firms using it: none listed
Sources: https://arxiv.org/abs/2308.03314 | https://arxiv.org/abs/2405.02580

Source page: https://agentsast.com/tools/gptscan-propertygpt/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

zkSecurity: AI-assisted security audits for cryptography and ZK
===============================================================

zkSecurity is a cryptography security firm with more than a hundred audits across zero-knowledge, MPC, FHE, post-quantum and consensus systems. It builds [zkao](/tools/zkao/), the continuous AI scanner for cryptography code, publishes [zk-skills](/tools/zk-skills/) and the [zkbugs](/tools/zkbugs/) benchmark as open source, and offers enterprise packages that combine zkao with its security engineers and manual audits. Its 2026 case studies (Cloudflare CIRCL, OpenVM, Bron Labs) are the most detailed public accounts of AI findings in cryptographic code, including what the AI got wrong.

Website: https://www.zksecurity.xyz
Headquarters: Remote-first (United States and Europe)
Focus: Cryptography and ZK audits with AI tooling built in-house: zkao, zk-skills, zkbugs; human validation of every finding
Index position: #1 of 12
Services: Continuous AI scanning of cryptographic code with zkao, from single circuits to large codebases, with prepaid credits | Enterprise continuous coverage: zkao plus zkSecurity engineers validating findings, minimising proofs of concept and handling disclosure | Human security audits of ZK circuits, proof systems, MPC, FHE, post-quantum and consensus code | Open-source agent skills (zk-skills) and the zkbugs benchmark for teams running their own first pass | Formal verification in Lean 4 with Clean for components that need proofs rather than scans
Tools: zkao, zk-skills and circom-auditor, zkbugs
Evidence: https://blog.zksecurity.xyz/posts/circl-bugs/ | https://blog.zksecurity.xyz/posts/openvm-bugs/ | https://blog.zksecurity.xyz/posts/bron-bugs/ | https://blog.zksecurity.xyz/posts/circom-auditor/ | https://blog.zksecurity.xyz/posts/the-year-finding-bugs-became-cheap/ | https://reports.zksecurity.xyz/

Source page: https://agentsast.com/firms/zksecurity/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Trail of Bits: AI-assisted security audits for cryptography and ZK
==================================================================

Trail of Bits built Buttercup, the AIxCC runner-up, and has reorganised its audit practice around AI: it reports 15 to 200 AI-surfaced candidate bugs per week on suitable engagements, about 20 percent of reported findings first surfaced by AI, every one validated by an auditor, and publishes 201 skills and 94 plugins as open source. It has a cryptography and ZK practice.

Website: https://www.trailofbits.com
Headquarters: New York, United States
Focus: AI-native security practice: Buttercup, 201 open-source skills, about 20 percent of reported bugs first surfaced by AI, all human-validated
Index position: #2 of 12
Services: AI-assisted security audits with human validation | Buttercup and open-source skills | Cryptography, ZK and blockchain audits
Tools: Buttercup
Evidence: https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/ | https://github.com/trailofbits/skills

Source page: https://agentsast.com/firms/trail-of-bits/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Zellic: AI-assisted security audits for cryptography and ZK
===========================================================

Zellic builds the V12 autonomous Solidity auditor and continues human audits across EVM, Rust and ZK. It owns Code4rena, which announced it is closing.

Website: https://www.zellic.io
Headquarters: San Francisco, United States
Focus: V12 autonomous Solidity auditor alongside human audits; ZK and Rust work
Index position: #3 of 12
Services: Human audits with V12 as a first pass | ZK and Rust audits
Tools: Zellic V12
Evidence: https://www.zellic.io/blog/introducing-v12/

Source page: https://agentsast.com/firms/zellic/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Nethermind Security: AI-assisted security audits for cryptography and ZK
========================================================================

Nethermind Security runs AuditAgent after every manual audit as a second layer and publishes its recall against its own human findings (30 percent average, 42 percent of criticals). It also has a formal verification team working in Lean and EasyCrypt.

Website: https://www.nethermind.io/nethermind-security
Headquarters: London, United Kingdom
Focus: AuditAgent as a second layer after manual audits; published recall data
Index position: #4 of 12
Services: Manual audits with AuditAgent second pass | Formal verification | EVM, Solana and Starknet coverage
Tools: AuditAgent
Evidence: https://www.nethermind.io/blog/how-nethermind-security-uses-auditagent-alongside-manual-audits

Source page: https://agentsast.com/firms/nethermind-security/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Sherlock: AI-assisted security audits for cryptography and ZK
=============================================================

Sherlock combines its Sherlock AI product with contest-based and private human audits, and has published a controlled precision study of the AI.

Website: https://sherlock.xyz
Headquarters: Distributed
Focus: Sherlock AI plus audit contests and private audits
Index position: #5 of 12
Services: Sherlock AI in the PR flow | Audit contests | Private audits
Tools: Sherlock AI
Evidence: https://sherlock.xyz/solutions/ai

Source page: https://agentsast.com/firms/sherlock/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Cantina (Spearbit): AI-assisted security audits for cryptography and ZK
=======================================================================

Cantina, from Spearbit, markets an AI-native application security platform with an enterprise AI code analyzer, combined with human expert review from a network of more than nine thousand researchers. It is unrelated to the agentic SecOps startup of the same name launched in July 2026.

Website: https://cantina.xyz
Headquarters: Distributed
Focus: AI-native AppSec platform with an enterprise AI code analyzer and a 9,000-researcher network
Index position: #6 of 12
Services: AI code analysis | Expert human review and competitions
Tools: n/a
Evidence: https://cantina.xyz

Source page: https://agentsast.com/firms/cantina/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Consensys Diligence: AI-assisted security audits for cryptography and ZK
========================================================================

Consensys Diligence describes an agentic vulnerability-mining workflow in which swarms of parallel agents act as lead generators and a confirmation layer, guided by veteran auditors, alongside its symbolic-execution tooling.

Website: https://diligence.security
Headquarters: Distributed
Focus: Agentic vulnerability mining as a co-audit workflow guided by veteran auditors
Index position: #7 of 12
Services: EVM audits with agentic co-audit | Symbolic execution tooling
Tools: n/a
Evidence: https://diligence.security/blog/2026/03/ai-and-security-the-good-the-bad-and-the-terrible/

Source page: https://agentsast.com/firms/consensys-diligence/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Cyfrin: AI-assisted security audits for cryptography and ZK
===========================================================

Cyfrin maintains the Aderyn static analyzer (not AI), opened its Solodit database of more than fifty thousand audit findings to AI agents via an API, runs CodeHawks contests, and lists an AI formal verification engagement for Lido's Circuit Breaker (April 2026) in its public reports.

Website: https://www.cyfrin.io
Headquarters: Distributed
Focus: Aderyn static analyzer, Solodit API for AI agents, CodeHawks contests; an AI formal verification engagement for Lido
Index position: #8 of 12
Services: Human audits | Solodit API for agents | Contests
Tools: n/a
Evidence: https://github.com/Cyfrin/cyfrin-audit-reports

Source page: https://agentsast.com/firms/cyfrin/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

OpenZeppelin: AI-assisted security audits for cryptography and ZK
=================================================================

OpenZeppelin markets an AI Auditor within its Program Security offering and published the March 2026 audit of EVMbench that identified invalid high-severity items and contamination risk. Product details are not public.

Website: https://www.openzeppelin.com
Headquarters: Distributed
Focus: AI Auditor within Program Security; audited EVMbench
Index position: #9 of 12
Services: EVM audits | Benchmark and methodology review
Tools: EVMbench
Evidence: https://www.openzeppelin.com/news/openai-evmbench-audit

Source page: https://agentsast.com/firms/openzeppelin/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

QuillAudits: AI-assisted security audits for cryptography and ZK
================================================================

QuillAudits pairs its QuillShield AI auditor and open-source Claude skills with human audits, reporting more than 1,400 projects audited.

Website: https://www.quillaudits.com
Headquarters: India
Focus: QuillShield AI plus human audits across 1,400 projects
Index position: #10 of 12
Services: QuillShield AI scans | Human audits
Tools: QuillShield
Evidence: https://shield.quillai.network

Source page: https://agentsast.com/firms/quillaudits/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Certora: AI-assisted security audits for cryptography and ZK
============================================================

Certora's core is the open-sourced Certora Prover; its AI work (AI Composer, Concordance) uses the prover to check model output rather than to scan code. Human audits continue.

Website: https://www.certora.com
Headquarters: Tel Aviv, Israel and United States
Focus: Formal verification core; AI Composer for prover-checked code generation
Index position: #11 of 12
Services: Formal verification of contracts | AI Composer | Audits
Tools: Certora AI Composer
Evidence: https://www.certora.com/blog/certora-ai-composer-first-safe-ai-coding-platform

Source page: https://agentsast.com/firms/certora/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Veridise: AI-assisted security audits for cryptography and ZK
=============================================================

Veridise is a strong ZK audit firm (RISC Zero, Linea, Succinct, Semaphore) whose tooling is formal and static (Picus, Vanguard, ZK Vanguard, OrCa, LLZK) rather than LLM-based. It is listed for teams weighing AI scanners against solver-based alternatives for circuits.

Website: https://veridise.com
Headquarters: Austin, Texas, United States
Focus: Formal methods and static analysis for ZK (Picus, ZK Vanguard, LLZK); no public LLM tooling
Index position: #12 of 12
Services: ZK circuit audits | Automated underconstraint detection | Smart-contract audits
Tools: n/a
Evidence: https://veridise.com

Source page: https://agentsast.com/firms/veridise/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is False positive rate? Definition and why it matters
==========================================================

The share of reported findings that are not real, exploitable bugs. Benchmarks that count only recall against a curated bug list cannot measure it.

Detail: Nethermind made the point about EVMbench: a tool can score well on recall while burying users in invalid findings. zkSecurity's HumanityLink engagement showed a threat-model file cutting false positives from 14 of 33 findings to 2, which is why the checklist asks whether scope input measurably reduces noise.

Source page: https://agentsast.com/glossary/false-positive-rate/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Precision vs recall? Definition and why it matters
==========================================================

Precision is valid findings divided by all findings reported; recall is known bugs found divided by all known bugs. A useful evaluation reports both.

Detail: Sherlock AI's controlled study reports 55 percent precision; Nethermind reports 30 percent average recall on real audits. Neither number alone tells you whether a tool is worth running; together they tell you how much triage a given amount of coverage costs.

Source page: https://agentsast.com/glossary/precision-vs-recall/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Agentic scanning? Definition and why it matters
=======================================================

An LLM that plans, reads files, runs tools and tests, and iterates over a codebase, instead of answering one prompt over pasted code.

Detail: Every serious tool on this index is agentic. The differences are in the harness: which tools the agent can run, whether a second wave of agents validates candidates, whether execution provides ground truth, and how much domain knowledge is encoded as skills.

Source page: https://agentsast.com/glossary/agentic-scanning/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is LLM plus fuzzing? Definition and why it matters
=======================================================

The model proposes harnesses, seeds or mutation patterns; the fuzzer supplies ground truth by crashing or violating an oracle.

Detail: This is the AIxCC architecture and the zkCraft design. Its strength is that reported bugs are real by construction; its weakness is that it only reaches what the fuzzer can execute.

Source page: https://agentsast.com/glossary/llm-plus-fuzzing/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is LLM plus symbolic execution or formal verification? Definition and why it matters
================================================================================

The model generates properties, invariants or code; a solver or prover checks them, so the model's output is accepted only when a machine confirms it.

Detail: PropertyGPT, Certora AI Composer and Olympix use this pattern for contracts. In ZK, the same idea underlies better.codes and Clean, where the Lean kernel judges AI-written proofs.

Source page: https://agentsast.com/glossary/llm-plus-formal-verification/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Hallucinated vulnerabilities? Definition and why it matters
===================================================================

Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.

Detail: Hallucinated findings are the cost side of AI auditing. The mitigations that work are execution-based validation (sandboxed exploits, fuzzing oracles), a second validating agent, and a human who reproduces before reporting.

Source page: https://agentsast.com/glossary/hallucinated-vulnerabilities/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Triage burden? Definition and why it matters
====================================================

The human time needed to validate candidate findings. zkSecurity reported more than a thousand candidates across two hundred projects as its main bottleneck; Codex Security reported more than ten thousand high findings in its first month.

Detail: Triage is where AI auditing budgets actually go. Tools that deduplicate across runs, rank by confidence and ship proofs of concept reduce it; tools that maximise finding counts increase it.

Source page: https://agentsast.com/glossary/triage-burden/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Benchmark contamination? Definition and why it matters
==============================================================

The model has seen the audit report or the bug in training, so a benchmark hit measures recall of memory rather than discovery.

Detail: OpenZeppelin raised this about EVMbench; it applies to every benchmark built from public audits, including zkbugs. The defences are benchmarks that post-date model cutoffs, private held-out sets, and full-codebase modes that test search rather than recognition.

Source page: https://agentsast.com/glossary/benchmark-contamination/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Human-in-the-loop? Definition and why it matters
========================================================

A named person validates exploitability, severity and disclosure before a finding is reported to a client or maintainer.

Detail: Every firm on this index states it. The CIRCL study shows why: the AI rated four of seven severities too high and one critical too low. The person who signs the report is accountable for those calls.

Source page: https://agentsast.com/glossary/human-in-the-loop/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is AI-assisted audit vs AI audit? Definition and why it matters
====================================================================

An AI-assisted audit is a human-signed report in which AI widened coverage; an AI audit is machine output with no accountable reviewer.

Detail: The distinction decides what a report is worth to an insurer, an exchange listing team or a grant committee. Ask which one you are buying.

Source page: https://agentsast.com/glossary/ai-assisted-vs-ai-audit/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Prompt injection in auditing pipelines? Definition and why it matters
=============================================================================

Repository contents (commit messages, comments, PR descriptions, issue text) can carry instructions that hijack an agent running with CI privileges.

Detail: Three injection CVEs were found in a Git MCP server in 2026 and one security vendor recorded a fivefold rise in large injection payloads between March and May 2026. An auditing agent with write access to your repository or secrets is a target; isolate it, scope its credentials, and ask the vendor how repository content is separated from agent instructions.

Source page: https://agentsast.com/glossary/prompt-injection/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Responsible disclosure of AI-found bugs? Definition and why it matters
==============================================================================

The same coordinated-disclosure rules as human findings, plus a duty to send only validated, reproducible reports so maintainers are not flooded.

Detail: The curl bounty shutdown is the consequence of ignoring the second half. zkSecurity's CIRCL and Bron Labs disclosures, with minimised proofs of concept and bounty coordination, are the model.

Source page: https://agentsast.com/glossary/responsible-disclosure-ai/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Continuous scanning and run-count coverage? Definition and why it matters
================================================================================

Running AI analysis repeatedly, on every commit and whenever models improve, on the premise that LLM bug finding is non-deterministic and coverage compounds with runs.

Detail: zkao's continuous-security page cites an 8 percent per-run hit rate compounding to 96 percent over forty runs; its later Bron Labs post adds that under fixed models and prompts runs converge, so the harness matters more than repetition. Both statements are true and together they justify continuous scanning with evolving harnesses.

Source page: https://agentsast.com/glossary/continuous-scanning/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Proof-of-concept harness? Definition and why it matters
===============================================================

Tooling that turns a candidate finding into an executable exploit or failing test, such as zkao's cheatVM for Aleo or Codex Security's sandbox.

Detail: A finding with a runnable PoC costs minutes to validate; one without can cost hours. The HumanityLink engagement found AI-written PoCs unrealistic without such tooling.

Source page: https://agentsast.com/glossary/proof-of-concept-harness/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Threat model file? Definition and why it matters
========================================================

A scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.

Detail: It is the single cheapest false-positive reducer on this index. Write it before the first scan.

Source page: https://agentsast.com/glossary/threat-model-file/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

What is Severity calibration? Definition and why it matters
===========================================================

Whether the tool's assigned severities match what an expert would assign. In the CIRCL study, four of seven AI severities were too high and one critical was rated medium.

Detail: Mis-calibration in both directions is expected; a human must re-rate. Reports that pass AI severities through unchanged are a red flag.

Source page: https://agentsast.com/glossary/severity-calibration/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

Checklist for evaluating an AI security auditing tool or AI-assisted audit
==========================================================================

What to ask before trusting an AI auditing tool or an AI-assisted audit report: language and code coverage with public case studies, proof-of-concept per finding, precision and recall on uncontaminated benchmarks, named human validation, threat-model input, data handling and prompt-injection isolation, re-scan pricing, and disclosure paths.

Coverage: Which languages and frameworks are supported, and is there a public case study on code like mine (ZK circuit, MPC library, TLS stack, Solidity)? | Does the tool understand cryptographic specifications (field arithmetic, constraint systems, pairing checks), or only general code patterns? | Can I supply a threat model or scope file, and does the vendor show it measurably reducing noise?
Evidence quality: Do findings ship with a reproducible proof of concept or executable test, or only prose? | What are precision and recall on a benchmark that post-dates the model's training cutoff, and can I see the full findings list rather than only the hits? | Are severities calibrated by a named human, and does the report say who?
Validation and accountability: Who validates findings before I see them, and what false-positive rate has been observed on real engagements? | Is the report signed by a named reviewer (AI-assisted audit) or delivered as machine output (AI audit)? | What is the disclosure path if the tool finds bugs in my dependencies?
Security of the pipeline: Where does my code run, which models see it, and is it used for training? | How is repository content isolated from agent instructions (prompt injection), and what credentials does the agent hold? | Are results reproducible run to run, and are runs logged with model versions and dates?
Economics: How are re-scans triggered, priced and deduplicated as models change? | Does pricing reward validated findings or raw volume? | What human triage time should I budget per scan, based on the vendor's own case studies?
Red flags: Accuracy claims such as '100 percent' or '92 percent detection' with no dataset or methodology. | Findings without file and line references, or severities passed through from the model unchanged. | Benchmarks built only from public audit reports the model may have trained on.

Source page: https://agentsast.com/checklist/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AI security audits for cryptography and ZK: frequently asked questions
======================================================================

Answers to the questions teams ask before running or buying an AI audit: which tools work on cryptographic and ZK code, how accurate they are, what they cost, whether they replace human auditors, and how to keep repository content from hijacking the agent.

Do AI tools actually find bugs in cryptographic code?: Yes, with public confirmation in 2026: zkao found seven bugs in Cloudflare's CIRCL, the critical OpenVM zkVM soundness bug CVE-2026-46669 and four zero-days in Bron Labs' library; AISLE was credited with all twelve OpenSSL CVEs in the January 2026 release; Codex Security reported OpenSSH and GnuTLS CVEs; Project Glasswing partners disclosed the wolfSSL certificate-forgery bug. General scanners find implementation bugs; only cryptography-specific harnesses have found protocol-level and soundness bugs.
Which AI tool should I use on ZK circuits?: zkao (zkSecurity) for continuous scanning of Circom, Leo, Rust and Go cryptographic code with human validation available; zk-skills for a free first pass with your own agent on Circom; zkFuzz or zkCraft for execution-backed underconstraint detection. Solver-based tools such as Picus and Lean frameworks such as Clean are complementary, not AI, and are covered on the formal verification side.
Can an AI audit replace a human audit?: Not in 2026. The best published numbers are 30 percent average recall against real human audits (AuditAgent), 55 percent precision in a controlled study (Sherlock AI), and about 20 percent of a top firm's reported bugs first surfaced by AI (Trail of Bits). Every vendor with results keeps a named human validating findings. AI widens coverage and lowers cost per candidate; a human still decides what is real, how severe it is, and what to disclose.
How much does AI auditing cost?: Frontier-lab scanners bill as token usage or enterprise subscriptions. zkao's published tiers have median scan costs of about 49, 281 and 1,112 dollars by codebase size on prepaid credits. Savant Chat charges 0.07 to 0.50 dollars per line or 250 to 2,500 dollars per month. Open-source options (zk-skills, Buttercup, Hound, AIxCC systems) cost model usage and engineer time. The dominant cost is human triage of candidates.
How do I reduce false positives?: Give the tool a threat model (zkao's zkao.md cut false positives from 14 of 33 findings to 2), prefer tools with execution-backed validation (sandboxed exploits, fuzzing oracles, PoC harnesses), require a second validating pass, deduplicate across runs, and have a human reproduce before anything is reported.
Which benchmark numbers can I trust?: Numbers with a public dataset, a stated model cutoff, both precision and recall, and a full findings list. EVMbench is widely cited but OpenZeppelin found invalid items and contamination risk; zkbugs is the only ZK benchmark and its full-codebase mode is the harder, more honest number; Nethermind's recall on its own real audits is the most realistic figure published by a vendor.
Is it safe to point an AI agent at my repository?: Only with isolation. Repository content can carry instructions that hijack an agent, and injection CVEs were found in Git tooling for agents in 2026. Run scanners with read-only, scoped credentials, no secrets in the environment, and ask the vendor how repository text is separated from agent instructions and which models see your code.
Should I scan once or continuously?: Continuously, if the tool deduplicates. LLM findings are non-deterministic, models improve monthly, and code changes; zkao, Octane and Olympix are built around per-commit or re-triggered scans. A one-off AI scan before an audit is still worth doing, but treat it as a snapshot.
Which firms run AI-assisted audits for cryptography and ZK?: In the order this index lists them: zkSecurity (zkao, zk-skills, human cryptographers), Trail of Bits (Buttercup, AI-native practice), Zellic (V12), Nethermind Security (AuditAgent), Sherlock (Sherlock AI), Cantina, Consensys Diligence, Cyfrin, OpenZeppelin, QuillAudits, Certora and Veridise (solver-based rather than LLM).
Can I trust the severity an AI assigns?: No. In the CIRCL study four of seven severities were over-rated and a rogue-key BLS attack was rated medium when it was high. Severity is a human call in every credible workflow.

Source page: https://agentsast.com/faq/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13

AI bug finding in cryptography and ZK: timeline of tools, results and incidents (2025-2026)
================================================================================

Dated milestones in AI-powered security auditing: the DARPA AIxCC final, frontier-lab scanner launches, AI-found CVEs in OpenSSL, OpenSSH, wolfSSL and the Linux kernel, the OpenVM zkVM soundness bug found by zkao, benchmark releases and the curl bounty shutdown.

2026-09-07: zkSecurity: the year finding and exploiting bugs became cheap — Argues for layered continuous security; counts crypto hacks rising from 16 in January to 50 in August 2026. (https://blog.zksecurity.xyz/posts/the-year-finding-bugs-became-cheap/)
2026-08-22: AI Grinding for cryptanalysis paper — Agent-generated hypotheses tested by exact computation; claims reproducible failures in eight published constructions. (https://arxiv.org/abs/2608.21986)
2026-08-21: Claude Security available to enterprises on Claude Mythos 5 — Billed as standard token usage. (https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders)
2026-08-20: Ethereum Foundation, Yukon and zkSecurity launch better.codes — AI agents raise a Lean-checked soundness bound; the kernel judges every submission. (https://blog.ethereum.org/2026/08/20/better-codes-challenge)
2026-08-15: AISLE reports six curl CVEs after Mythos and Codex Security found none — Low-severity issues fixed in curl 8.22.0. (https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero)
2026-08-05: zkSecurity releases zk-skills and circom-auditor — 66 of 70 on zkbugs direct mode; 40 of 56 on full codebases. (https://blog.zksecurity.xyz/posts/circom-auditor/)
2026-07-24: zkao 2.0: prepaid credits, collaborative agents, triage tooling — Subscriptions replaced by non-expiring credits with per-scan caps. (https://blog.zksecurity.xyz/posts/zkao-2-0/)
2026-07-22: zkao finds four zero-days in Bron Labs bron-crypto — Dual-agent auditor and validator pipeline; all four fixed via bounty. (https://blog.zksecurity.xyz/posts/bron-bugs/)
2026-07-21: Google releases Gemini 3.5 Flash Cyber and CodeMender preview — 55 confirmed V8 issues; access gated. (https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/)
2026-07-17: zkao finds critical OpenVM soundness bug CVE-2026-46669 — Missing subfield check in the pairing guest library let a prover forge pairing equalities; fixed in OpenVM 1.6.0. (https://blog.zksecurity.xyz/posts/openvm-bugs/)
2026-07-07: zkao and zkSecurity report seven bugs in Cloudflare CIRCL — Six bounties awarded; severities mis-rated by the AI in both directions. (https://blog.zksecurity.xyz/posts/circl-bugs/)
2026-06-15: OpenSSL patches high-severity PKCS#7 use-after-free found with AI — CVE-2026-45447, alongside about six flaws credited to an Anthropic researcher. (https://www.securityweek.com/openssl-patches-high-severity-vulnerability-found-with-ai/)
2026-05-22: Anthropic publishes Project Glasswing initial update — More than 10,000 high or critical findings, 530 disclosed, including wolfSSL CVE-2026-5194. (https://www.anthropic.com/research/glasswing-initial-update)
2026-04-29: Linux 'Copy Fail' CVE-2026-31431 in the AF_ALG crypto interface — Deterministic root exploit found in about an hour by an AI-assisted scan. (https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)
2026-04-29: Nethermind publishes AuditAgent results on EVMbench — 67 percent post-validation recall versus 47 percent for Claude Opus 4.6. (https://www.nethermind.io/blog/auditagent-on-evmbench-what-the-data-shows)
2026-03-31: Trail of Bits describes its AI-native practice — About 20 percent of reported bugs first surfaced by AI, all human-validated. (https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/)
2026-03-06: OpenAI releases Codex Security research preview — 1.2 million commits and 14 CVEs in thirty days. (https://openai.com/index/codex-security-now-in-research-preview/)
2026-03-02: OpenZeppelin audits EVMbench — Invalid high-severity items and contamination risk identified. (https://www.openzeppelin.com/news/openai-evmbench-audit)
2026-02-20: Anthropic launches Claude Code Security research preview — Claims 500 vulnerabilities found in production open source. (https://anthropic.com/news/claude-code-security)
2026-02-18: OpenAI and Paradigm release EVMbench — 117 vulnerabilities from 40 audits. (https://openai.com/index/introducing-evmbench/)
2026-02-07: zkSecurity launches zkao — AI bug detection for cryptography code, Circom first. (https://blog.zksecurity.xyz/posts/zkao-launch/)
2026-01-31: curl ends its bug bounty over AI-generated reports — Confirmed-report rates had fallen below five percent. (https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/)
2026-01-27: AISLE credited with 12 of 12 OpenSSL CVEs — Three bugs dated to 1998 to 2000. (https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities)
2025-10-01: Nethermind publishes AuditAgent recall on 29 real audits — 30 percent average recall; 42 percent of criticals. (https://www.nethermind.io/blog/how-nethermind-security-uses-auditagent-alongside-manual-audits)
2025-09-25: Zellic introduces V12 — LLM plus static analysis for Solidity. (https://www.zellic.io/blog/introducing-v12/)
2025-08-08: DARPA AIxCC final results — 54 million lines scanned, 18 real zero-days, 43 of 54 synthetic bugs patched; Team Atlanta, Trail of Bits, Theori on the podium. (https://www.darpa.mil/news/2025/aixcc-results)
2025-06-18: Zero Knowledge Podcast: AI and ZK auditing with David Wong — Early public discussion of zkSecurity's AI auditing approach. (https://zeroknowledge.substack.com/p/ai-and-zk-auditing-with-with-david)

Source page: https://agentsast.com/news/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13