AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare

Anthropic, OpenAI, Cloudflare and Google each now ship an AI agent that hunts security bugs in source code, and all four converge on the same design: one agent finds a bug, a separate agent tries to disprove it, and only survivors get a patch. The tools differ in where they run, who can use them and how much proof they demand — Claude Security runs inside Claude Code with no extra API key, Codex Security's CLI is Apache-2.0 but scanning needs OpenAI access, Cloudflare's skill is MIT and model-agnostic, and Google's Mantis reproduces bugs in a sandbox. The article attributes the shared pattern to noisy scanning (Google cites true-positive rates under 7%) and to attackers already using AI to find exploitable flaws.