# agentsast

> AI bug-finding and auditing tools for cryptographic code, zero-knowledge circuits and smart contracts: what each one actually finds, what it costs, and which firms stand behind the results.

Compiled by the agentsast editors (agentsast). Last reviewed 2026-09-13. Every page has a summary.txt and data.json sibling; site-wide JSON at /api/index.json.

## Cryptography and ZK specialists

- [Category guide](https://agentsast.com/categories/crypto-zk/): Tools built for the code that general scanners handle worst: finite-field arithmetic, constraint systems, pairing libraries, MPC and post-quantum implementations. zkao (zkSecurity) is the only product in this class with public, upstream-confirmed critical findings; zk-skills makes the same audit patterns available as open-source agent skills; zkCraft adds LLM guidance to circuit fuzzing.
- [zkao](https://agentsast.com/tools/zkao/): zkao is zkSecurity's AI-powered continuous security scanner for cryptography code: ZK circuits, MPC protocols, FHE schemes, end-to-end encryption, TLS stacks and post-quantum primitives. It connects to a GitHub repository, runs multi-agent analysis built from zkSecurity's audit patterns, validates findings with a second wave of agents and re-runs scans as models improve. Its public results in 2026 include seven confirmed bugs in Cloudflare's CIRCL library, the critical OpenVM zkVM soundness bug CVE-2026-46669, and four zero-days in Bron Labs' bron-crypto, all fixed upstream.
- [zk-skills and circom-auditor](https://agentsast.com/tools/zk-skills/): zk-skills is zkSecurity's open-source set of security skills for Claude Code, Codex and Cursor. Its circom-auditor skill scores 66 of 70 known bugs with Claude Opus 4.8 and 64 of 70 with GPT-5.5 on the zkbugs benchmark in direct mode, and 40 of 56 and 14 of 56 on full original codebases, against 30 of 70 and 8 of 56 for the Ecne tool. It is positioned as a pre-audit first pass, with zkao as the continuous deep option.
- [zkCraft (with zkFuzz)](https://agentsast.com/tools/zkcraft/): zkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.
- [AI Grinding for cryptanalysis (research)](https://agentsast.com/tools/ai-grinding-cryptanalysis/): A 2026 paper describing an autonomous cryptanalysis workflow in which agents produce many low-precision hypotheses and an exact, adversarially controlled test decides which count as evidence. It claims reproducible failures in eight published constructions and is the reference for applying the candidate-plus-oracle pattern to cryptography itself rather than code.

## Frontier-lab and general scanners

- [Category guide](https://agentsast.com/categories/frontier/): General-purpose vulnerability scanners from Anthropic, OpenAI and Google, plus independent products such as AISLE and XBOW. They target C, C++, and mainstream application code and have produced CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, SQLite, FFmpeg and V8. They are not cryptography-aware, but cryptographic libraries are written in the languages they scan.
- [Claude Security](https://agentsast.com/tools/claude-security/): Claude Security is Anthropic's vulnerability scanner, launched as Claude Code Security in a February 2026 research preview, opened to enterprises in May 2026 with a reported 2,100 vulnerabilities patched in three weeks, shipped as a Claude Code plugin in July 2026, and running on Claude Mythos 5 for enterprise customers from 21 August 2026. Anthropic's Project Glasswing partners reported more than 10,000 high or critical findings by May 2026, including the wolfSSL certificate-forgery CVE-2026-5194.
- [Codex Security (formerly Aardvark)](https://agentsast.com/tools/codex-security/): Codex Security is OpenAI's agentic security scanner, announced as Aardvark in October 2025 with a claimed 92 percent detection rate on benchmark repositories and released as a research preview in March 2026. In its first thirty days it scanned 1.2 million commits, reported 792 critical and 10,561 high findings and 14 CVEs including OpenSSH, GnuTLS and Chromium, and claimed up to 84 percent noise reduction through sandboxed validation.
- [Big Sleep and CodeMender](https://agentsast.com/tools/big-sleep/): Big Sleep is Google's LLM-based bug hunter, credited with 20 flaws in FFmpeg and ImageMagick in August 2025 and with catching SQLite CVE-2025-6965 before exploitation. CodeMender (preview) validates and patches, and Gemini 3.5 Flash Cyber (July 2026) found 55 confirmed V8 issues. None is sold as a product to the public.
- [AISLE](https://agentsast.com/tools/aisle/): AISLE is an autonomous analyzer for C source code credited with all twelve CVEs in OpenSSL's 27 January 2026 release (three dating to 1998 to 2000), twenty OpenSSL zero-days in six months, and six low-severity curl CVEs in August 2026 after curl's maintainer noted that Mythos and Codex Security had reported none.
- [XBOW](https://agentsast.com/tools/xbow/): XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.

## Cyber reasoning systems (DARPA AIxCC)

- [Category guide](https://agentsast.com/categories/aixcc/): The seven finalists of DARPA's AI Cyber Challenge, all open-sourced after the August 2025 final. They combine LLMs with fuzzing and program analysis to find and patch bugs in C and Java, processed 54 million lines of code in the final, found 18 real zero-days and patched 43 of 54 synthetic bugs. OpenSSF's OSS-CRS packages them for open-source maintainers.
- [Atlantis](https://agentsast.com/tools/atlantis/): Atlantis won DARPA's AI Cyber Challenge (4 million dollar first prize) with an ensemble of independent LLM and fuzzing modules that share seeds, and found the most real-world bugs in the final.
- [Buttercup](https://agentsast.com/tools/buttercup/): Buttercup placed second in AIxCC (3 million dollars), finding 28 vulnerabilities across 20 CWEs at 90 percent accuracy and about 181 dollars per point using only non-reasoning models. Trail of Bits released a version that runs on a laptop.
- [RoboDuck](https://agentsast.com/tools/roboduck/): RoboDuck placed third in AIxCC (1.5 million dollars) with a pipeline that relies on LLM reasoning alone to produce proofs of vulnerability, without fuzzing or symbolic execution.
- [OSS-CRS and other AIxCC finalists](https://agentsast.com/tools/oss-crs/): OSS-CRS is OpenSSF's effort to integrate the open-sourced AIxCC finalist systems, including Shellphish's ARTIPHISHELL, BugBuster, all-you-need-is-a-fuzzing-brain and Lacrosse, so open-source maintainers can run them against OSS-Fuzz projects.

## Smart-contract AI auditors

- [Category guide](https://agentsast.com/categories/smart-contracts/): Commercial and open-source AI auditors for Solidity, Vyper, Rust (Solana), Move and Cairo. Published recall against human audits ranges from about 30 percent (Nethermind AuditAgent on its own audits) to about 70 percent on the EVMbench benchmark; precision on live code is around 55 percent in the one controlled study (Sherlock AI). Several also cover ZK circuit languages.
- [Sherlock AI](https://agentsast.com/tools/sherlock-ai/): Sherlock AI is Sherlock's Solidity auditor. In Sherlock's own controlled benchmark on the Flayer and Moongate codebase, scored by an independent researcher, version 2.2 produced 21 valid findings out of 38 (55 percent precision) against 4 of 8 for GPT-5.2 and 1 of 16 for Claude Sonnet 4.5.
- [AuditAgent](https://agentsast.com/tools/auditagent/): AuditAgent is Nethermind's smart-contract auditing agent. On 29 real Nethermind audits it averaged 30 percent recall (up to 50 percent), catching 42 percent of criticals and 43 percent of highs and finding valid issues in 62 percent of projects; on EVMbench it reported 67 percent post-validation recall against 47 percent for Claude Opus 4.6 and 38 percent for GPT-5.2. It retroactively flagged the ResupplyFi exploit.
- [Zellic V12](https://agentsast.com/tools/zellic-v12/): Zellic V12 is an autonomous Solidity auditor combining LLMs with static analysis. Zellic reported 39 findings across live audits, Cantina contests and a Pendle bug, and a 70.6 percent detect score on EVMbench (March 2026). Its co-founder describes it as matching junior auditors but not top firms.
- [Savant Chat](https://agentsast.com/tools/savant-chat/): Savant Chat is a multi-agent auditor with the broadest language list on this index, including Circom, Halo2, Noir and arkworks alongside Solidity, Rust, Move and Cairo. It placed sixth in Sherlock's Symbiotic contest in September 2025, a contest with no high or critical findings.
- [Olympix](https://agentsast.com/tools/olympix/): Olympix is a commercial CI tool for Solidity that combines an intermediate representation, custom detectors, symbolic execution, fuzzing and mutation testing with AI, producing executable proofs of concept on every commit.
- [Octane Security](https://agentsast.com/tools/octane/): Octane provides continuous AI scanning with one-click fixes across EVM, Solana, Aptos, Sui and Cosmos, backed by a seed round led by Archetype and Winklevoss Capital.
- [Hound](https://agentsast.com/tools/hound/): Hound is an open-source auditing agent that builds relation-first knowledge graphs of a codebase and maintains persistent vulnerability hypotheses. On a ScaBench subset it reported 34 true positives against 9 for the baseline, with recall of 31.2 percent versus 8.3 percent.
- [QuillShield](https://agentsast.com/tools/quillshield/): QuillShield is QuillAudits' AI auditing product for Solidity, complemented by open-source Claude skills that decompose contract behaviour, model threats and simulate adversaries.
- [Cecuro](https://agentsast.com/tools/cecuro/): Cecuro published a benchmark of 90 contracts exploited between October 2024 and early 2026 (228 million dollars lost) and reports its agent detecting 92 percent of the value at risk against 34 percent for a baseline GPT-5.1 agent. The benchmark and baseline are open; the agent is not.
- [Certora AI Composer](https://agentsast.com/tools/certora-ai-composer/): Certora AI Composer pairs LLM code generation with the Certora Prover so generated Solidity is checked against invariants before it is accepted. It is a secure-generation tool rather than a scanner, and the clearest example of LLM plus formal verification.
- [Immunefi Magnus](https://agentsast.com/tools/immunefi-magnus/): Magnus is Immunefi's security operations platform combining Security Swarm AI agents, Fuzzland's AI fuzzing and the CODEX vulnerability dataset with its bounty infrastructure.

## Benchmarks and research

- [Category guide](https://agentsast.com/categories/benchmarks/): The datasets used to score AI bug finders, and the research systems that established the methods. zkbugs is the only ZK-specific benchmark; EVMbench (OpenAI and Paradigm) is the most cited for Solidity and the most criticised for contamination; CyberGym and BountyBench cover general software. Read the methodology before the headline number.
- [zkbugs](https://agentsast.com/tools/zkbugs/): zkbugs is zkSecurity's benchmark and knowledge base of zero-knowledge circuit vulnerabilities (139 catalogued across ZK DSLs), with reproducible cases used to score zk-skills at 66 of 70 in direct mode and 40 of 56 on full codebases. The companion site bugs.zksecurity.xyz is the public ZK bug tracker.
- [EVMbench](https://agentsast.com/tools/evmbench/): EVMbench contains 117 vulnerabilities from 40 audits with detect, patch and exploit modes; GPT-5.3-Codex scored 72.2 percent in exploit mode against 31.9 percent for GPT-5. OpenZeppelin's audit found at least four invalid high-severity items and training-data contamination risk, and a re-evaluation paper followed.
- [ScaBench and SCONE-bench](https://agentsast.com/tools/scabench/): ScaBench draws ground truth from 31 projects audited on Code4rena, Cantina and Sherlock and is the benchmark behind Hound's published recall; SCONE-bench is Anthropic's smart-contract benchmark.
- [CyberGym, BountyBench and SEC-bench](https://agentsast.com/tools/cybergym/): CyberGym (1,507 instances from 188 projects, with an end-to-end variant), BountyBench (40 offence and defence tasks) and SEC-bench are the main general-software benchmarks for AI vulnerability discovery, and the ones frontier labs cite.
- [GPTScan and PropertyGPT (research)](https://agentsast.com/tools/gptscan-propertygpt/): GPTScan (ICSE 2024) combined GPT with static analysis for Solidity logic bugs, reporting over 90 percent precision on token contracts and 57 percent on large projects with 9 new bugs. PropertyGPT (NDSS 2025) generates formal properties for smart contracts with retrieval augmentation, the ancestor of LLM plus prover tools.

## Firms (in index order)
- [zkSecurity](https://agentsast.com/firms/zksecurity/): Cryptography and ZK audits with AI tooling built in-house: zkao, zk-skills, zkbugs; human validation of every finding
- [Trail of Bits](https://agentsast.com/firms/trail-of-bits/): AI-native security practice: Buttercup, 201 open-source skills, about 20 percent of reported bugs first surfaced by AI, all human-validated
- [Zellic](https://agentsast.com/firms/zellic/): V12 autonomous Solidity auditor alongside human audits; ZK and Rust work
- [Nethermind Security](https://agentsast.com/firms/nethermind-security/): AuditAgent as a second layer after manual audits; published recall data
- [Sherlock](https://agentsast.com/firms/sherlock/): Sherlock AI plus audit contests and private audits
- [Cantina (Spearbit)](https://agentsast.com/firms/cantina/): AI-native AppSec platform with an enterprise AI code analyzer and a 9,000-researcher network
- [Consensys Diligence](https://agentsast.com/firms/consensys-diligence/): Agentic vulnerability mining as a co-audit workflow guided by veteran auditors
- [Cyfrin](https://agentsast.com/firms/cyfrin/): Aderyn static analyzer, Solodit API for AI agents, CodeHawks contests; an AI formal verification engagement for Lido
- [OpenZeppelin](https://agentsast.com/firms/openzeppelin/): AI Auditor within Program Security; audited EVMbench
- [QuillAudits](https://agentsast.com/firms/quillaudits/): QuillShield AI plus human audits across 1,400 projects
- [Certora](https://agentsast.com/firms/certora/): Formal verification core; AI Composer for prover-checked code generation
- [Veridise](https://agentsast.com/firms/veridise/): Formal methods and static analysis for ZK (Picus, ZK Vanguard, LLZK); no public LLM tooling

## Glossary
- [False positive rate](https://agentsast.com/glossary/false-positive-rate/): The share of reported findings that are not real, exploitable bugs. Benchmarks that count only recall against a curated bug list cannot measure it.
- [Precision vs recall](https://agentsast.com/glossary/precision-vs-recall/): Precision is valid findings divided by all findings reported; recall is known bugs found divided by all known bugs. A useful evaluation reports both.
- [Agentic scanning](https://agentsast.com/glossary/agentic-scanning/): An LLM that plans, reads files, runs tools and tests, and iterates over a codebase, instead of answering one prompt over pasted code.
- [LLM plus fuzzing](https://agentsast.com/glossary/llm-plus-fuzzing/): The model proposes harnesses, seeds or mutation patterns; the fuzzer supplies ground truth by crashing or violating an oracle.
- [LLM plus symbolic execution or formal verification](https://agentsast.com/glossary/llm-plus-formal-verification/): The model generates properties, invariants or code; a solver or prover checks them, so the model's output is accepted only when a machine confirms it.
- [Hallucinated vulnerabilities](https://agentsast.com/glossary/hallucinated-vulnerabilities/): Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.
- [Triage burden](https://agentsast.com/glossary/triage-burden/): The human time needed to validate candidate findings. zkSecurity reported more than a thousand candidates across two hundred projects as its main bottleneck; Codex Security reported more than ten thousand high findings in its first month.
- [Benchmark contamination](https://agentsast.com/glossary/benchmark-contamination/): The model has seen the audit report or the bug in training, so a benchmark hit measures recall of memory rather than discovery.
- [Human-in-the-loop](https://agentsast.com/glossary/human-in-the-loop/): A named person validates exploitability, severity and disclosure before a finding is reported to a client or maintainer.
- [AI-assisted audit vs AI audit](https://agentsast.com/glossary/ai-assisted-vs-ai-audit/): An AI-assisted audit is a human-signed report in which AI widened coverage; an AI audit is machine output with no accountable reviewer.
- [Prompt injection in auditing pipelines](https://agentsast.com/glossary/prompt-injection/): Repository contents (commit messages, comments, PR descriptions, issue text) can carry instructions that hijack an agent running with CI privileges.
- [Responsible disclosure of AI-found bugs](https://agentsast.com/glossary/responsible-disclosure-ai/): The same coordinated-disclosure rules as human findings, plus a duty to send only validated, reproducible reports so maintainers are not flooded.
- [Continuous scanning and run-count coverage](https://agentsast.com/glossary/continuous-scanning/): Running AI analysis repeatedly, on every commit and whenever models improve, on the premise that LLM bug finding is non-deterministic and coverage compounds with runs.
- [Proof-of-concept harness](https://agentsast.com/glossary/proof-of-concept-harness/): Tooling that turns a candidate finding into an executable exploit or failing test, such as zkao's cheatVM for Aleo or Codex Security's sandbox.
- [Threat model file](https://agentsast.com/glossary/threat-model-file/): A scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.
- [Severity calibration](https://agentsast.com/glossary/severity-calibration/): Whether the tool's assigned severities match what an expert would assign. In the CIRCL study, four of seven AI severities were too high and one critical was rated medium.

## Other
- [Checklist](https://agentsast.com/checklist/)
- [FAQ](https://agentsast.com/faq/)
- [Timeline](https://agentsast.com/news/)
- [About and methodology](https://agentsast.com/about/)
- [JSON API](https://agentsast.com/api/index.json)