AI security-bug agents spend 60.4% of tokens on code understanding; AVRI cuts cost

A study of 200 runs across four AI agents hunting security bugs found that 60.4% of tokens went to understanding code and reasoning about how to trigger the bug, according to a post by Rohan Paul summarizing the work.

The authors built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, AVRI cut total cost 18.0% for Codex and 23.7% for OpenCode without lowering success or recall, per the same report.

The report also says that only 24.4% of comparisons against the plain agent kept success while lowering cost, which is why the authors built AVRI.