AI security tools battle noise with multi-agent verification

In 2026, four major companies—Anthropic, OpenAI, Cloudflare, and Google—launched AI security agents designed to detect vulnerabilities in code. These tools use a shared approach: one agent identifies potential bugs, while another independently verifies them, ensuring only valid findings lead to patches. Google’s security team highlighted that traditional AI scanners often produce false positives, with true-positive rates under 7%, making them inefficient for code reviews. Anthropic’s Claude Code Security plugin runs locally and generates detailed reports in Markdown and SARIF format, while OpenAI’s Codex Security offers a CLI and SDK for scanning repositories and generating security policies. Cloudflare’s security-audit-skill, released in June 2026, enables any coding agent to act as a security auditor, with built-in validation and sandboxing. Google’s Mantis tool, which uses historical data to improve efficiency, also emphasizes reproducibility and patch verification. The trend shows a growing reliance on multi-agent systems to reduce noise and improve accuracy, with each vendor emphasizing unique validation methods and integration strategies.