AI can now investigate software vulnerabilities, test whether they are exploitable and help develop corrections. The opportunity for businesses is significant, but so are the questions about reliability, security and control.
Companies have security tools. Why do vulnerabilities still take so much work to fix?
Imagine a software company with dozens of applications, frequent code releases and a small application-security team.
Every day, developers change code, update dependencies and connect applications to new services. Existing security tools scan those changes and identify potential weaknesses.
Some findings are straightforward. A vulnerable dependency might need an upgrade, or a hardcoded credential might need to be removed.
Others require deeper investigation.
A scanner may report suspicious code, but determining whether it represents a real vulnerability can involve several services, authentication rules, data flows and deployment settings.
A security engineer investigates the finding. A developer explains the application behavior. Someone reproduces the issue, proposes a correction and tests the result.
Meanwhile, more code arrives.
The company does not necessarily lack security tools. Its challenge is turning security findings into confirmed and resolved problems.
That is the business problem a new generation of AI security systems is trying to address.
Recent developments from Anthropic, OpenAI, Google, GitHub and specialized security companies suggest that AI can take on more of the investigation surrounding a vulnerability.
But what can these systems actually do? And how should a company decide whether they are worth adopting?
From finding suspicious code to investigating security weaknesses
Automated vulnerability detection is not new.
Organizations already use static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secret detection and penetration testing.
Each method answers different questions. Static analysis examines code or its representation. Dynamic testing examines running applications. Dependency scanning identifies known issues in third-party software. Penetration testing investigates whether weaknesses can be exploited within an authorized scope.
These capabilities remain important.
The difficulty is that identifying suspicious behavior is not always the same as understanding its security consequences.
A reasoning-based agent may investigate how several files, services and permissions work together. It can develop a hypothesis, examine supporting evidence and propose additional tests.
That makes a different kind of security investigation possible.
Accessible text alternative for this figure
Conventional flow: Scan, Findings, Triage, Developer fix, Review and retest.
Agent-assisted flow: Understand context, Investigate, Validate, Propose a tested fix, Independent review.
The two flows are conceptual. Existing scanners already automate scanning, and no single agent is claimed to perform every stage.
The important change is not that security scanning becomes automated. It already was.
The change is that software may increasingly assist with the work between detection, validation and remediation.
What Claude Security and GPT-6 Cyber actually represent
Two recent announcements illustrate different parts of this development.
Claude Security: Continuous application-security investigation
Anthropic’s Claude Security connects to software repositories, examines relationships across code and builds threat-model context.
That context starts from the code. Teams can edit the threat model and add deployment context and architecture documents, which Anthropic says Claude may otherwise miss.
The hosted service supports baseline scanning, recurring analysis of code changes, finding validation, remediation assistance and tracking of unresolved issues.
It was available in beta for Enterprise plan users at the research cutoff, and it needs a premium seat for each user and usage credits. A project can connect up to eight repositories.
What distinguishes the offering from an ordinary one-off coding-assistant conversation is the surrounding workflow. It maintains project context and tracks findings as the code changes.
This could reduce the effort required to reconstruct an application’s architecture every time a security issue appears.
But Anthropic also documents an important limitation: two scans of the same code can produce different findings because the agent’s investigation is stochastic.
That raises a question about how organizations should establish repeatable security assurance.
GPT-6 Cyber: Deeper vulnerability and exploit research
OpenAI’s GPT-6 Cyber approaches the problem differently.
It is a specialized cybersecurity model designed for advanced vulnerability research, including validating whether weaknesses can be exploited.
OpenAI reports a 48.5% success rate on its ExploitGym benchmark, compared with 32.1% for GPT-5.6 Cyber, in its own evaluation.
The company also reports that its researchers used the model to develop working exploits for 948 Linux kernel vulnerabilities and to find 81 previously unknown vulnerabilities in Firefox that Mozilla classified as high severity.
These results indicate progress on specific cybersecurity research tasks. They do not mean the model will identify 48.5% of an enterprise’s vulnerabilities or reduce its security risk by a corresponding amount.
OpenAI classifies the model’s cybersecurity capability as Critical under its Preparedness Framework. OpenAI says the model is initially available through its API and Codex to a select group of approved customers in its Daybreak Red program.
This is not the same product category as a repository-connected security scanning service.
Claude Security is primarily a packaged application-security workflow. GPT-6 Cyber provides specialized model capability that can support advanced security research and other authorized tools.
The comparison matters because businesses should not mistake a capable model for a complete security service.
Who else is building similar capabilities?
Anthropic and OpenAI are not operating alone. Several companies are approaching different parts of the same security challenge.
| Provider or service | Primary focus | Important distinction |
|---|---|---|
| Claude Security | Repository security investigation | Continuous scanning, context and fix tracking. Beta for Enterprise plan users |
| Google CodeMender | Vulnerability discovery, verification and patch generation | Local testing and exploit verification. Preview for a limited set of customers through Google Cloud sales, not for production use |
| GitHub Agentic Autofix | Fixing code-scanning alerts | Validates changes against CodeQL and prepares pull requests. Generally available since October 15, 2026 for Code Security and Advanced Security on GitHub Enterprise Cloud, default-branch alerts only |
| Semgrep Agentic AppSec | Agent-assisted security analysis | Combines program-analysis tools, persistent context and agent workflows. Available to Semgrep customers, with the context layer in private beta |
| Snyk Agent Fix | Developer security remediation | Extends existing vulnerability-management and fix workflows. Snyk reports its own benchmark results |
| XBOW | Autonomous penetration testing | Tests within a customer-defined scope. XBOW says deterministic checks validate findings before they are reported |
| Palo Alto Networks Unit 42 | Continuous enterprise exposure assessment | Expert-led, multi-model managed service |
Comparison reflects different primary purposes, not a ranking. Availability and supported capabilities must be reviewed for the specific subscription or deployment.
These offerings reveal something important.
Google CodeMender combines AI reasoning, security testing and generated patches. GitHub’s Agentic Autofix starts from existing code-scanning alerts, works through relevant files, reruns CodeQL and opens a draft pull request. Semgrep combines agent workflows with specialized program analysis rather than relying on model reasoning alone.
XBOW and Palo Alto Networks extend further into penetration testing and validation of attack paths. Palo Alto Networks also uses multiple models and expert oversight rather than relying on one model to perform every security task.
Several of these tools run commands or open pull requests on your behalf, so the access they need is part of the decision.
The market is therefore not one simple category of AI security products.
A company should first establish whether it needs better code scanning, vulnerability validation, remediation assistance, penetration testing or security-operations investigation.
Only then does comparing vendors become meaningful.
What happens when an AI agent investigates a real application problem?
Consider a fictional financial application.
A customer signs in and requests account information using an API. The application verifies that the customer is authenticated, but one endpoint does not check whether the requested account actually belongs to that customer.
This is an authorization weakness.
A conventional scanner might detect some forms of this problem, but the underlying issue can be difficult because each individual function may look reasonable.
Understanding the vulnerability requires following the relationship between the authenticated user, the account identifier and the business rules controlling access.
| Stage | What needs to happen | Where an agent may help |
|---|---|---|
| Discovery | Identify an endpoint with suspicious access checks | Trace identity and account data across functions |
| Investigation | Determine whether account ownership is enforced | Examine connected services and authorization logic |
| Validation | Establish whether unauthorized access is possible | Propose tests in an authorized isolated environment |
| Remediation | Correct the missing ownership check | Generate a targeted code change |
| Verification | Prove legitimate access works and unauthorized access fails | Run security and functional regression tests |
| Release | Deploy the approved correction | Provide evidence for independent review |
Illustrative scenario, not a real incident or a demonstration of a particular vendor’s performance.
The agent’s potential advantage is its ability to connect information from several stages rather than requiring engineers to reconstruct every relationship manually.
But a successful security result requires more than an agent saying the vulnerability is fixed.
The corrected application must enforce the intended access rules. Existing legitimate operations must continue working. Tests must be relevant, and the correction must reach the environment where the weakness existed.
A security agent may reduce the effort required to reach that outcome.
It should not be treated as the final authority on whether the outcome has been achieved.
Where could companies see business value?
The strongest opportunity may be reducing the gap between discovering a vulnerability and applying a verified correction.
Faster investigation
Complex security findings can consume substantial engineering time. An agent with suitable application context may help engineers understand attack paths and identify the affected components.
More useful remediation guidance
A finding that identifies the cause of a weakness and proposes a testable correction can be more useful than an alert containing only a location and severity.
More frequent assessment
Continuous or repeated investigation may identify some issues earlier than occasional assessments, especially where applications change frequently.
Better use of limited security expertise
Developers and security engineers may spend less time gathering routine context and more time examining consequential findings, designing controls and approving corrections.
These are potential benefits, not guaranteed improvements.
| What companies want | What they should measure |
|---|---|
| Fewer unresolved security risks | Time to verified remediation and remaining exposure |
| Less investigation effort | Human review and investigation time per confirmed issue |
| Better findings | Validated true positives, false positives and missed vulnerabilities |
| Safer corrections | Functional and security regressions after a proposed fix |
| Better economics | Total cost per verified remediation, including tool usage and rework |
A vendor might report discovering substantially more vulnerabilities or completing investigations much faster.
Those results deserve attention, but organizations should ask what was measured, which baseline was used and whether the results apply to their own environments.
A benchmark showing better exploit-development performance does not establish enterprise return on investment. Even a vendor’s own audit can change a headline result: AWS reduced its 35 captured flags to 33 verified exploits once it examined how each flag was obtained.
Likewise, a tool that produces more findings may not reduce risk if those findings remain unresolved.
The business objective is not to generate the largest security report.
It is to reduce meaningful exposure with acceptable cost and disruption.
Why greater security capability also creates greater responsibility
A security agent needs access to do useful work.
It might need to read source code, inspect configuration, run tests, communicate with tools or propose changes across repositories.
Advanced security testing may require controlled exploitation against specifically authorized targets.
Those capabilities create a new security boundary.
Suppose an agent reads documentation containing malicious instructions. If the agent treats that untrusted material as an instruction rather than evidence, it might attempt an unauthorized action.
This is one form of prompt injection.
A highly capable agent could also produce unsafe patches, expose sensitive information, consume unexpected resources or attempt actions outside its approved scope.
The surrounding security architecture must therefore control the agent independently of its reasoning.
| Agent activity | Appropriate boundary |
|---|---|
| Read relevant source code | Explicit repository and data scope |
| Analyze findings | Evidence recorded against identifiable versions |
| Execute tests or exploit demonstrations | Isolated, authorized targets and controlled tools |
| Propose code modifications | Restricted write permissions and reviewable changes |
| Merge or deploy corrections | Independent approval and existing release controls |
| Handle sensitive information | Defined retention, access and processing policies |
OWASP’s AI Agent Security guidance emphasizes least privilege, tool authorization, protection against prompt injection, controlled execution and human approval for consequential operations.
Data-handling arrangements also differ between products. For example, Anthropic states that the hosted Claude Security service does not support Zero Data Retention. It separately documents a Claude Code security plugin for organizations requiring other deployment arrangements.
That distinction illustrates why a company must review the actual service and deployment terms rather than rely on a product name alone.
Security agents can be powerful tools, but they must not be allowed to create new unmanaged access paths into the systems they are supposed to protect.
Can businesses rely on security agents that do not always produce the same results?
Anthropic’s documentation explicitly states that Claude Security scans are stochastic.
A reasoning agent can investigate different paths during different runs, even against the same code.
That can be valuable. A flexible investigation may uncover a business-logic flaw that a fixed rule does not recognize.
But it also limits what a clean result can establish.
If an agent finds no critical vulnerability on one scan, the organization cannot assume that every relevant attack path was examined.
Traditional security tools have limitations too. A deterministic scanner may reliably repeat its checks while still failing to detect vulnerabilities outside its rules or analysis capabilities.
The stronger architecture may therefore combine different kinds of evidence:
- Repeatable security checks establish known coverage.
- Reasoning agents investigate contextual and complex weaknesses.
- Controlled tests validate important findings.
- Human reviewers assess business impact and consequential decisions.
- Subsequent testing checks whether corrections remain effective.
This is an architectural recommendation, not a claim that one particular vendor has solved the problem.
The goal should be dependable security outcomes, not exclusive reliance on either traditional scanners or AI reasoning.
Will security engineers become less important?
AI may automate portions of vulnerability discovery, investigation and remediation.
But application security is not simply the ability to recognize insecure code.
Someone still needs to understand business processes, identify critical assets, define acceptable risk, design access policies and determine whether a correction is appropriate.
AI can help gather evidence for those decisions. It does not automatically acquire organizational authority or accountability, a gap explored in AI Is Getting Better at Doing the Work. But Is It Ready to Own the Outcome?
The more realistic near-term possibility is that security engineers spend less time on certain repetitive tasks and more time evaluating complex risks, supervising automated investigations and ensuring that agents operate safely.
Some organizations may improve coverage without growing teams at the same rate as their software portfolios.
Others may need new expertise in agent security, tool permissions, model behavior and evaluation.
The evidence does not yet justify a general prediction that AI security agents will replace security engineers.
It supports a narrower conclusion: the activities and skills involved in security engineering are likely to change as these tools mature.
Should companies adopt these technologies now?
Not every organization needs another security platform.
A company with many repositories, experienced security reviewers and a substantial vulnerability backlog may have a strong reason to evaluate agent-assisted investigation.
A smaller development team may find that extending an existing GitHub, Semgrep or Snyk workflow is more practical than buying a separate service.
An organization working with highly sensitive code or tightly regulated systems may need to establish data-handling, isolation and authorization requirements before conducting even a limited evaluation.
| Organization’s situation | Sensible next action |
|---|---|
| Mature AppSec program and substantial unresolved findings | Run a controlled comparison against the existing workflow |
| Small team already using security tools with AI features | Evaluate capabilities already included in current platforms |
| Highly sensitive applications or infrastructure | Establish access, data-processing and execution safeguards first |
| No reliable scanning, ownership or remediation process | Fix those fundamentals before expecting AI to compensate |
| Interested in advanced exploit research | Use suitably authorized specialist services and controlled environments |
Start with one representative business problem and decide what success means before testing.
For example: can an agent-assisted workflow help resolve a set of confirmed vulnerabilities more accurately or economically than the current process?
A practical test: take a set of vulnerabilities your team has already confirmed and fixed, run both your current workflow and the agent-assisted one on the same set, and compare time to verified remediation, missed findings and regressions.
Measure actual outcomes, including missed vulnerabilities and unsafe changes. Evaluate the total cost rather than the price of the AI tool alone.
And keep important actions, particularly exploit execution, merging security fixes and production changes, within independently enforced authorization controls.
An evaluation that concludes the technology is not yet useful for a particular organization is still valuable. It can prevent a larger investment without supporting evidence.
The larger change is not about replacing scanners
AI-assisted software development has made it easier to generate and modify code. That increases the importance of security practices capable of keeping up with changing applications.
Agentic security systems are one possible response.
They can connect code understanding, vulnerability investigation, validation and remediation in ways that were previously difficult to automate.
The emerging market already includes repository-security platforms, AI-assisted remediation, autonomous penetration testing and expert-led multi-model services.
These technologies are not equivalent, and the evidence behind their performance claims varies.
Businesses should assess them according to the security work they need completed, not by the sophistication of the model or the excitement surrounding a launch.
The fundamental objective of cybersecurity has not changed.
Companies still need to identify weaknesses, understand their consequences and correct them before they cause harm.
What is changing is how much of that work software may be able to perform, and how carefully companies must control the software performing it.
Go deeper
These sources provide technical details, product boundaries and relevant security guidance.
- Anthropic: Use Claude Security: Repository analysis, continuous scanning, threat models, findings, remediation and documented limitations.
- OpenAI: GPT-6 Cyber, November 5, 2026: Specialized cyber-model capabilities, benchmarks, authorized research and safety controls.
- Google Cloud: CodeMender overview: Vulnerability discovery, verification and patch generation, including preview limitations.
- GitHub: Agentic Autofix general availability, October 15, 2026: Code-scanning alert remediation and integration with reviewable pull requests.
- Semgrep: Agentic AppSec Platform, November 12, 2026: Agentic security workflows supported by program analysis and persistent code context.
- Palo Alto Networks: Unit 42 Continuous Frontier AI Defense: Continuous exposure discovery, validation and expert-led multi-model security services.
- OWASP: AI Agent Security Cheat Sheet: Practical controls for agent permissions, tool use, prompt injection, execution and human review.
- Snyk: Agent Fix agentic architecture, April 27, 2026: How Snyk describes automated code remediation and its own benchmark results.
- XBOW: We ran 1,060 autonomous attacks, March 2, 2026: XBOW’s description of autonomous penetration testing, scope control and validation.
Sources were read on November 13, 2026. Product availability and vendor figures are the vendors’ own and can change.