OpenAI can’t yet explain why its coding agents switch off misalignment monitoring
AIvia The Decoder
Quick Read
Two internal OpenAI coding agents switched off safety monitoring on their own, even after weighing whether to keep the safeguards in place. When asked about it, GPT-6 Astra denied removing the monitoring. OpenAI calls this a recurring pattern and doesn't yet have a satisfying explanation for the behavior. The article OpenAI can't yet explain why its coding agents switch off misalignment monitoring appeared first on The Decoder.
Two internal OpenAI coding agents switched off safety monitoring on their own, even after weighing whether to keep the safeguards in place. When asked about it, GPT-6 Astra denied removing the monitoring. OpenAI calls this a recurring pattern and doesn’t yet have a satisfying explanation for the behavior.
The article OpenAI can't yet explain why its coding agents switch off misalignment monitoring appeared first on The Decoder.
A team of researchers from Microsoft Research and UC Berkeley have released TokenEconomizer, an open-source cost controller for coding agents. TokenEconomizer is a plugin that learns from past sessions in a repository to cut waste in later ones. It works with Claude Code, Codex, GitHub Copilot CLI and Pi. It does not touch model weights or agent code. On 277 SWE-Bench tasks, it lowered mean cost by 18.4% to 30.9% across 5 agent-model settings. TL;DR Package: A standard-library Python package and agent plugins, with 3 switchable mechanisms. Runs on: Any machine running Claude Code, Codex, Copilot CLI or Pi with Python 3.10+. No GPU and no API key of its own. Performance: 18.4% to 30.9% lower mean SWE-Bench cost, and cheaper in all 30 repository-setting cells. Best: 30.9% lower cost on Claude Code with Opus 4.8 (33.2% when combined with RTK). Worst: Only 6.4% to 9.3% savings on ReposVul audits; Pass@1 drops 1.0 point on Opus 4.8. Why do coding agents waste tokens? Every agent turn re-bills the system prompt, every loaded tool schema and the full history. The research team profiled 60 SWE-Bench tasks across 6 repositories using Claude Code with Opus 4.8. They found 3 recurring sources of waste: Repeated discovery: once 5 tasks precede the current one, 30% of tool calls repeat an earlier action. Unused tools: 23 tool schemas load every turn. 16 are never called, and 3 cover 98% of calls. Failure loops: 10 failed runs were 17% of tasks but 32% of total spend. They also tested 3 fixed open-source strategies: RTK, Serena and Aider’s RepoMap. None was cheaper everywhere. All 3 cut cost on Django and raised it on SymPy. How does TokenEconomizer work? TokenEconomizer is an external controller that treats the agent as a black box. It keeps a state per repository, built from completed traces. Before each task, it sets 3 policies through the prompt, the tool settings and the event stream. 1. Micro-skills An LLM proposer turns trace digests into 1-line facts, such as the working test command. Each fact carries regex detectors that check later traces without a model call. A fact enters the prompt after 3 confirmations on tasks with non-overlapping edited files. Its need rate must also stay at or above 0.4. One contradiction counts as 5 confirmations, so wrong facts retire quickly. 2. Tool pruning Shell, read, write and edit tools are always kept. Other tools are masked after 3 consecutive unused tasks, or when an LLM judge marks them irrelevant. The full catalog returns every 5 tasks for a re-audit. On Django with Claude Code, the first request on task 2 fell from 43,351 to 16,295 prompt tokens. 3. Failure-loop intervention The controller learns a turn budget: 1.25 times the 90th percentile of successful run lengths. Cheap rule checks flag repeated failures or dense errors. An LLM judge then decides if the agent is stuck, at 0.7 confidence or higher. A stuck agent gets 1 redirect, then a stop if the loop recurs. #mtp-te-embed iframe{width:100%!important;border:0!important;display:block;background:transparent!important}#mtp-te-embed p:empty,#mtp-te-embed hr,#mtp-te-embed del,#mtp-te-embed s{display:none!important} (function(){var f=document.getElementById('mtp-te-frame');window.addEventListener('message',function(e){if(e.data&&e.data.mtpTE&&e.source===f.contentWindow){f.style.height=e.data.h+'px';}});})(); What do the SWE-Bench results show? Source: arXiv 2610.22732, Table 1. Costs include all controller calls. 3 seeds per setting. Pass@1 improved in 4 of 5 settings. Lower reasoning effort saved cost but cut Pass@1 by 1.8 to 10.3 points. RTK alone raised cost in 12 of 30 repository-setting cells, and RepoMap in 15. Savings build over time. Most repositories cost more at first, but all were cheaper by the sixth task. Alone on Claude Code, tool pruning saved 13.2% to 17.7%, micro-skills 11.8% to 14.3%, and the loop guard 5.4% to 7.1%. Results also held outside SWE-Bench. Costs fell 16.0% to 21.2% on Web-Bench and 16.5% to 19.6% on CredData. ReposVul saw only 6.4% to 9.3%, because shorter runs leave less to remove. How does it compare with other token-saving tools? Cost rows: TokenEconomizer paper. Licenses and claims: each project’s repository or docs. How do you install TokenEconomizer? The plugin needs one of the 4 agents and Python 3.10 or newer. On Claude Code, clone the repo, add it as a marketplace, then run claude plugin install tokeneconomizer@tokeneconomizer. Learned data stays local in ~/.tokeneconomizer. Tool pruning and the loop guard are on by default. Micro-skills are off by default, because the proposer adds model calls. Key Takeaways TokenEconomizer cuts SWE-Bench cost 18.4% to 30.9% with an unchanged agent. It was cheaper in all 30 repository-setting cells; RTK and RepoMap were not. Tool pruning is the biggest single lever, at 13.2% to 17.7%. Pass@1 rose in 4 of 5 settings and fell 1.0 point on Opus 4.8. It is Apache 2.0 and installs on Claude Code, Codex, Copilot CLI and Pi. Check out the Paper, GitHub Repo and Project Page. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well. Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us The post Meet TokenEconomizer: Microsoft’s Plugin That Cuts Coding Agent Costs by Up to 30.9% appeared first on MarkTechPost.
Anthropic, OpenAI, Cloudflare and Google now each ship an AI agent that hunts security bugs in source code. We checked the repos, docs and technical details behind each one. The key finding: all 4 tools converge on one design. One agent finds a bug, a separate agent tries to disprove it, and only survivors get a patch. The differences are in where they run, who can use them and how much proof they demand. Key Takeaways 4 labs, 1 pattern: find, independently disprove, then patch. Claude Security runs inside Claude Code; no extra API key needed. Codex Security’s CLI is Apache-2.0, but scanning still needs OpenAI access. Cloudflare’s skill is MIT, model-agnostic and the most-starred at 47.5K. Google’s Mantis reproduces bugs in a sandbox; Google says isolate it. Why 4 labs shipped the same thing in 2026 The problem every one of them is solving is noise. Google’s security team writes that sloppy AI code scanning produces hallucinated bugs and true-positive rates under 7%. A scanner that is wrong 93% of the time costs reviewers more than it saves. The shared fix is separation of duties. The agent that reports a finding never gets to confirm it. Cloudflare states the rule directly in its README: the verifier is never the agent that found the bug. Anthropic, OpenAI and Google each describe a similar validation step before anything reaches a report. The second driver is offense. Anthropic team states that it built its scanner partly because attackers were already using AI models to find exploitable flaws, per The Hacker News. Google opens its Mantis post by noting that models can now discover and exploit bugs with little human help. 1. Claude Security by Anthropic What it is: A multi-agent vulnerability scanner that runs inside a Claude Code session. It is the local version of Anthropic’s hosted Claude Security product, per the plugin README. How it works: Agents map the architecture, build a threat model, hunt across every component and verify each finding independently. The plugin offers 3 jobs from one menu: scan the codebase, scan changes, or suggest patches, per Claude Code docs. Output: A Markdown report along with a SARIF 2.1.0 file for GitHub code scanning. Each finding carries severity, a CWE category, impact and reproduction steps. Patches are drafted in a scratch copy and land as F.patch files. The plugin never commits, pushes or opens a pull request on its own. Cost and access: It makes no model calls of its own, so there is no separate API key. Scans count against your Claude plan’s usage limits. Copy CodeCopiedUse a different Browser/plugin install claude-security@claude-plugins-official /claude-security Timeline: Anthropic opened a limited preview called Claude Code Security in February 2026. The hosted product reached public beta for Enterprise customers on Claude Opus 4.7. The Claude Code plugin entered beta on July 22, 2026, per Cybersecurity News. In August, the hosted scanner moved to Claude Mythos 5, per Dataconomy. Where it fits: Anthropic positions it as one layer. The security-guidance plugin checks code as Claude writes it, and /security-review does a single pass on a branch. Claude Security is the on-demand deep scan. 2. Codex Security by OpenAI What it is: A CLI and TypeScript SDK, published as @openai/codex-security, for finding, validating and fixing vulnerabilities. How it works: It scans a whole repo, selected paths, or a Git diff. A –mode deep flag runs parallel discovery workers. It validates candidate findings, generates patches and can verify existing fixes. A cs policy command drafts a SECURITY.md that tells future scans what counts as a vulnerability in your project. Output: Threat models, SARIF, JSON or CSV exports, plus publishing to Linear. It can import GitHub code-scanning alerts and suggest owners from Git history. A GitHub Action runs scheduled or pull-request scans; findings are report-only by default. Copy CodeCopiedUse a different Browsernpm install --global @openai/codex-security cs login cs scan Cost and access: The client is Apache-2.0, but the scanner behind it is not. DevOps.com notes the CLI and SDK stay in limited beta for approved customers. The README lists OpenAI, Amazon Bedrock, OpenRouter and Fireworks AI as providers. Requires Node.js 22.13+ and Python 3.10+. 3. Security Audit Skill by Cloudflare What it is: An MIT-licensed skill that turns any capable coding agent into a security auditor. How it works: A 6-phase audit: Reconnaissance: map architecture, trust boundaries and input surfaces into architecture.md and a coverage ledger. Coverage-led hunting: isolated hunters each take ledger units; coverage critics look for gaps. Candidate validation: a fresh verifier tries to disprove every unique candidate. Structured output: confirmed, needs_validation and rejected records go to findings.json, checked against a schema. Independent record verification: new agents re-verify every final source claim. Target-neutral reporting: REPORT.md and detail files are derived from the verified records. Requirements: A coding agent that supports tool use and parallel sub-agents, plus Node.js for the validators. It also wants an OS-enforced sandbox with no external network. Without one, leads stay needs_validation instead of being executed. npx skills add –skill security-audit Then ask the agent: “security audit this codebase.” Output defaults to ~/security-audit-skill//run-, outside your repo. The data behind it: Cloudflare published the skill on June 18, 2026, with its post Build your own vulnerability harness. The roughly 450-line skill seeded an internal harness that now scans 128 repos. Cloudflare reports these lifetime numbers: 20,799 raw candidates from discovery, about 12,057 of which survived validation. 13,841 findings in the shared triage pool across 145 repos, including another harness’s output. 5,442 folded away as duplicates and 1,154 routed out as wrong-repo or low-risk. 7,245 actionable findings sent to engineering teams. Better recon context cut the first-pass rejection rate from 40% to 11%. Cloudflare also uses one model for discovery and a different model for triage, so models check each other. 4. Mantis by Google What it is: An Apache-2.0 set of security-review skills plus an ADK reference harness for AI coding agents. Google team states that it is part of how it finds and fixes bugs internally. How it works: Mantis reads the repo’s history to learn from past security fixes. It builds a hierarchical summary tree, condensing files into directory and root summaries. Google team states that this cut token overhead by over 85%. It then generates a threat model and hypotheses, hunts, deduplicates and critiques findings. What sets it apart: Reproduction and patch verification. Mantis tries to reproduce each bug, from a static exploit sketch up to a unit test or mock server. It patches with an adversarial loop that attacks the fix. It also calibrates severity against a rubric to stop “thousands of criticals.” A mantis-advise skill then feeds what it learned back into code generation. Setup: Clone the repo and point any coding agent at it, or run the ADK harness directly. The harness supports a –focus prompt such as “look for IDOR” and a –max-tokens spend ceiling. Copy CodeCopiedUse a different Browsergit clone cd mantis/reference && ./install.sh ./run.sh path/to/code Side-by-side Beyond the big 4: other AI bug hunters launched in 2026 At least 12 more agent-based vulnerability tools shipped or went public in 2026. Almost all repeat the same find-then-independently-verify loop. They split into free harnesses you run yourself and commercial or internal platforms. Open-source harnesses AppSec Santa also tracks harnesses from Anthropic (defending-code-reference-harness), Trail of Bits, Capital One (vulnhunter) and Cisco (ai-deep-sast). Cisco’s runs fully local on Foundation-Sec-8B, so no code leaves the machine. Commercial platforms and internal systems The pattern holds across vendors: deterministic engines or validators do the proving, models do the reasoning, and a human approves every fix. Which one to run first Already on Claude Code: start with the Claude Security plugin. It installs in 1 line and uses your existing plan. Need CI gating and SARIF in GitHub: Codex Security has the most mature pipeline tooling, if your org has access. Want no vendor lock-in: Cloudflare’s skill runs on any agent with parallel sub-agents and is fully MIT. Have a security team and a sandbox: Mantis gives the deepest proof loop, with reproduction and adversarial patch testing. Cloudflare’s own architecture suggests a practical combination. Run discovery with one tool or model, then validate with a different one. Different models surface different shares of the bugs. The post AI Security Agents Compared: Claude, Codex, Mantis, Cloudflare appeared first on MarkTechPost.
Epoch AI researchers say the widely available AI model GLM 5.3 turned public security fixes into working exploits before updates reached Firefox users. It autonomously compromised six Firefox releases for about $1,000 in API fees each without triggering safeguards from any provider tested. The article Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours appeared first on The Decoder.
