A static analyzer tells you line 412 might overflow. It's been telling you that for three sprints, alongside two hundred other maybes, and you've learned to scroll past. An autonomous vulnerability agent does something a linter never will: it writes an input that actually overflows line 412, watches the process crash in a sandbox, then hands you a patch plus a regression test proving the crash is gone.
That gap — between flag and prove — is the reason a wave of these systems landed in the fall of 2025, and the reason they're worth understanding at the mechanism level rather than the press-release level.
In a five-week stretch, three serious ones went public. Google DeepMind announced CodeMender. OpenAI announced Aardvark. And at DEF CON 33 that August, DARPA closed out its two-year AI Cyber Challenge (AIxCC), whose seven finalist systems were built to do exactly this and were then open-sourced. Different labs, different models, and — this is the interesting part — nearly the same architecture.
The loop is the product, not the model
It's tempting to read "GPT-5 finds bugs" and assume the model is the whole trick. It isn't. Drop a frontier LLM on a million-line C codebase and ask "any vulnerabilities?" and you get confident, plausible, frequently wrong prose. What makes these agents useful is the closed loop wrapped around the model — a pipeline that forces every claim to survive contact with a running program before a human sees it.
All three systems run a version of the same four beats: understand the code, find a candidate flaw, prove it's exploitable, patch the root cause. The proving step is what separates an agent from a chatbot with repo access.
Stage 1 — Model the system, then read the diffs
Aardvark begins by reading a whole project and producing a threat model: what this code protects, where trust boundaries sit, what "bad" would even mean here. Only then does it watch incoming commits, checking each change against that model. The ordering matters. A per-line rule fires on syntax; a threat model catches the change that's individually innocent but violates an invariant three files away.
CodeMender attacks the same problem with heavier machinery — static and dynamic analysis, differential testing, fuzzing, and SMT solvers wired into the agent as tools — so its reasoning about control and data flow is grounded in solver output rather than vibes.
Stage 2 — Prove it, or drop it
This is the load-bearing stage. On finding a candidate, Aardvark tries to trigger it in an isolated sandbox and only reports the finding if the exploit fires. The AIxCC systems were scored on the same principle: a bug report counted only when paired with a proof-of-vulnerability input that demonstrably reached the flaw.
The payoff is the death of the maybe. If the agent can't build a working trigger, the finding never reaches your queue — the correct handling of the false positives that turned older tools into background noise. Conceptually the loop looks like this:
def process_finding(candidate, repo):
trigger = build_exploit(candidate, repo) # concrete input, not a hunch
if not run_in_sandbox(trigger).crashed:
return None # unprovable -> discard, no alert
patch = generate_patch(candidate, repo) # Codex / Gemini writes the fix
if run_in_sandbox(trigger, patch).crashed:
return retry_or_escalate(candidate) # fix didn't hold
if regressions(repo, patch): # differential test vs. original
return retry_or_escalate(candidate)
return HumanReview(candidate, trigger, patch) # a person still signs off
The two sandbox runs bracket the whole thing: one proves the bug exists, the second proves the patch removes it. A fix that doesn't stop the original trigger, or that breaks an existing test, loops back instead of shipping.
Stage 3 — Fix the cause, not the crash
A patch that silences one crash while leaving the pattern intact is theater. CodeMender is explicit about targeting root cause: it runs an LLM-based critique tool that diffs original against modified code to catch regressions, and it validates that a change is functionally correct and style-consistent before surfacing it. Its headline example isn't a one-line null check — it applied -fbounds-safety annotations across the libwebp image library so the compiler inserts bounds checks automatically, structurally closing the class of buffer overflow behind CVE-2023-4863, the heap overflow used in a zero-click iOS exploit.
That's the ambition: not "patch this bug" but "make this bug un-writable."
What the numbers actually say
The results are real, and worth stating precisely.
- CodeMender upstreamed 72 security fixes to open-source projects over six months, some in codebases up to 4.5 million lines — every patch human-reviewed before submission.
- Aardvark identified 92% of known and synthetically injected vulnerabilities on benchmark repositories, per OpenAI, and helped land 10 CVEs in open-source software; it's in private beta.
- AIxCC finalists analyzed 54 million lines, patched 43 of 54 synthetic vulnerabilities they found, and surfaced 18 previously unknown real-world ones — at an average of $152 and 45 minutes per task.
Note what none of the three claim: full autonomy. CodeMender routes every patch to a human. Aardvark produces a Codex patch for a human analyst to approve. The agent's job is to arrive at review having already done the tedious, falsifiable work — reproduce, fix, regression-check — so a person adjudicates evidence instead of chasing a maybe.
The shift isn't "AI writes the fix." It's that the fix arrives with a proof it works and a proof it didn't break anything else.
The takeaway
If you own a service, the practical move isn't to wait for one of these to graduate from beta. It's to build the substrate they need now: a sandbox that can run your code against a hostile input, a fuzz or differential-test harness in CI, and a threat model precise enough that "exploitable" has a definition. Those are exactly the artifacts an agent's proof step depends on — and, not coincidentally, the same ones that make your own engineers faster today. The agents are converging on a workflow that was always good hygiene. Adopt the workflow; the agents will slot into it when they're ready.
Sources: Introducing CodeMender — Google DeepMind, Introducing Aardvark — OpenAI, AI Cyber Challenge results — DARPA, OpenAI Unveils Aardvark — The Hacker News