Agents In UseDefensive security work such as reviewing code, investigating risks and applying hardening steps. Validate findings before changing production systems.
51 use casesShowing 25–48
Preparing search…
tedagentic.comClaude's prompt audit found a standing token-leaking Git rule. The owner approved changes, configured CLI authentication and checked a dry-run push and remotes.
Added
Claudevia Claude Code prompt audit
devpost.comCodex debugged an Astartis MCP control plane with seven inspection and simulation tools; its creator retained policy authority and gated destructive functions.
Added
Codexvia Codex with GPT-5.6
accomplish.aiOren Yomtov tested Codex patch and JavaScript trust boundaries, reported two sandbox failures, and documented separate vendor fixes within eight days.
AddedCodexvia Codex CLI and Desktop in controlled security evaluations
joshuamckiddy.comCodex produced malware assessments and evidence-backed IOC artifacts in FLARE-VM. Incomplete strings stayed labelled; execution required engineer approval.
AddedCodexvia Codex CLI in FLARE-VM
arxiv.orgCodex traced Java call paths to vulnerable dependencies and generated executable proofs. Build feedback and human validation checked what the tests showed.
AddedCodexvia Codex CLI in PoVSmith; GPT assessment
github.comCodex changed ARJ extraction to validate archive members before disk writes, reject unsafe paths, and stop on listing failures, with maintainer review.
AddedCodex
uglyrobot.devCodex reviewed SaaS security and repaired findings in worktrees. Other agents checked reproductions before human merges; no audit acceptance was claimed.
AddedCodex
note.comCodex independently reviewed event registration and found actor-identity gaps, an overbooking race and a privileged SQL boundary before human acceptance.
AddedCodexvia Codex CLI reviewer; Claude Code implemented changes
vett.shCodex and Claude Code packaged a deliberately modified skill in a local test. Receiver logs exposed side effects beyond packaging and approval messages.
AddedCodexvia Codex and Claude Code comparison
kkm-mako.comCodex and Claude Code attempted isolated CVE patches. Attack proofs rejected fixes that passed normal tests; one strongly guided Codex attempt succeeded.
AddedCodexvia Codex; Claude Code comparison
forum.cursor.comByron reports Cursor safety rules catching attempts to inspect an environment file, log a Firebase secret and stage a repository before ignore rules were ready.
Added
Cursoraccomplish.aiOr Hiltch traced Cursor CLI’s internal Git outside its shell sandbox, used negative controls, and repeated three clean tests after the vendor hardened Git.
AddedCursorvia Cursor CLI on macOS in a controlled security evaluation
pillar.securityEilon Cohen’s Cursor test turned workspace Stop hooks into unapproved host execution; the benign proof led to CVE-2026-48124 and a patched Desktop version.
AddedCursorvia Cursor Desktop 2.4.37 in a controlled evaluationgithub.comDevin cached derived MCP roles while checking fresh access epochs on every request, fixed a restoration gap and shipped revocation tests in a merged Kody PR.
Added
Devinvia Devin cloud workspacegithub.comDevin reproduced a planted proxy-authentication chain in a sandbox and proposed a tested secret-gated patch, with human review and no deployed-fix claim.
AddedDevinAlice Ryhl credited Gemini CLI with diagnosing a Rust Binder zero-length array bug, selected enum variants and submitted a signed patch with tester credit.
Added
Geminivia Gemini CLIpillar.securityA Gemini CLI triage evaluation exposed ignored tool limits and excessive identity scope; Google fixed both, with sandbox and prompt changes disclosed.
AddedGeminivia Gemini CLI in an authorized triage evaluation
linkedin.comCopilot agent mode helped a timed security competition with files, scripts and browser tools. The participant restarted stalls and documented context drift.
Added
GitHub Copilotvia VS Code agent mode with Sonnet, Gemini and Grok modelsgithub.comCopilot bound approval reuse to current commits and enabled stale-review dismissal; the unmerged draft also corrected clean-sweep reporting and pinned CI.
AddedGitHub Copilotvia Copilot coding agentgithub.comCopilot proposed guards for verified signup passwords, deletion confirmation and malformed hashes; the draft retained reset-token risks for human review.
AddedGitHub Copilotvia Copilot coding agentgithub.comCopilot proposed IPv4 and USB-ID validation plus quoted generated commands for a Home Assistant add-on; the open patch retained privilege and address limits.
AddedGitHub Copilotvia Copilot coding agentgithub.comCopilot moved a monitoring token from WebSocket URLs into a coordinated header handshake; the open draft still awaited review and documented remaining risks.
AddedGitHub Copilotvia Copilot coding agentgithub.comCopilot narrowed Kibana’s KQL template regex and added ReDoS cases; a reviewer approved the merged patch while agent-side checks faced firewall blocks.
AddedGitHub Copilotvia Copilot coding agent
blindcyber.comResearchers tested Copilot's workspace boundary with a fake-key reproduction. A restricted reader had an alternate tool path; Microsoft patched the flaw.
AddedGitHub Copilotvia GitHub Copilot agent tools in VS Code