AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare
Anthropic, OpenAI, Cloudflare and Google now each ship an AI agent that hunts security bugs in source code. We checked the repos, docs and technical details behind each one. The key finding: all 4 tools converge on one design. One agent finds a bug, a separate agent tries to disprove it, and only survivors get a patch. The differences are in where they run, who can use them and how much proof they demand. Key Takeaways 4 labs, 1 pattern: find, independently disprove, then patch. Claude Security runs inside Claude Code; no extra API key needed. Codex Security’s CLI is Apache-2.0, but scanning still needs OpenAI access. Cloudflare’s skill is MIT, model-agnostic and the most-starred at 47.5K. Google’s Mantis reproduces bugs in a sandbox; Google says isolate it. Why 4 labs shipped the same thing in 2026 The problem every one of them is solving is noise. Google’s security team writes that sloppy AI code scanning produces hallucin...
