ai
3 posts · all writing
Your agent doesn't have a token problem: what raw scanner output costs an AI assistant
Four scanners on one small repo produce 2.3 MB to report 56 findings, and the bytes are the least of it. A third of those findings arrive with no severity, in three different path conventions, describing the same leaked key under two names. Something has to translate that before an agent can act.
Why we didn't build an AI pentester
Models can find bugs in code they've never seen. That commoditizes the pentester's craft, and leaves untouched the thing security tooling is actually for: the same answer, every time, cheap enough to run on every commit, with evidence someone will accept.
Your coding assistant is already answering security questions
Ask an assistant to check your repository for security problems and it will, by running whatever scanner it can find, over a scope it chose. On our demo app that missed 78 of the 99 things you'd fix first, all of them in a container image nothing told it about.