Who Audits the Agent? Security Review Is a Category

Coding agents now author more than 10% of merged PRs at Monzo and handle 1,800 tasks per day. GEICO runs an “AI war room” that burns $1,000 in tokens daily, coordinating agent fleets against legacy codebases. Across the industry, agents aren’t writing toy code anymore — they’re shipping load-bearing production software. And the question nobody had a good answer for six months ago is suddenly the question everyone is scrambling to productize: who reviews the agent’s work for security?

The answer, as of this week, is that “security review for agents” has crossed from wishful roadmap item to a shippable product category. The surface signal is Cloudflare’s security-audit-skill sitting at 37,000 stars on GitHub, gaining 2,000 per day, ranked #2 trending globally. But the signal underneath is bigger: an entire ecosystem — academic benchmarks, open-source scanners, commercial toolkits, industry standards, and real breaches — has converged to create both the demand and the supply side of this market simultaneously.

View original post on X →

Cloudflare’s Six-Phase Architecture: Why This Repo Matters

The security-audit-skill is not a linter. It is not a static analysis ruleset. It is a multi-agent orchestration pattern for security auditing, released under the MIT license, that turns a coding agent into a structured security auditor through six phases:

1. Reconnaissance — Maps architecture, trust boundaries, input surfaces, and prior evidence into structured artifacts (architecture.md, coverage-ledger.json).
2. Coverage-led hunting — Assigns isolated hunter agents to ledger units with coverage critics identifying gaps.
3. Candidate validation — Gives each unique candidate finding to a fresh verifier whose job is to disprove it.
4. Structured output — Writes confirmed, needs_validation, and rejected records to findings.json, validated against a JSON schema.
5. Independent record verification — Fresh agents check the final source claims. Material replacements get another independent verifier.
6. Reporting — Generates REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from verified records.

The critical design decision is in Phase 3: adversarial verification. The agent that discovers a potential vulnerability never gets to confirm its own finding. A separate, clean-context agent is spun up whose explicit mandate is to try to disprove it. This is the architectural equivalent of separation of duties in financial auditing — and it directly addresses the core failure mode of LLM-based security review: confirmation bias.

The repo has 37,000 stars (up from zero in August), 2,300 forks, and just 14 commits on main. That ratio — enormous adoption, minimal code surface — tells you something important: people aren’t starring this for the JavaScript. They’re starring it for the pattern.

When the repo hit HN with 213 points, the thread immediately split between practitioners who saw the adversarial-verification pattern as overdue and skeptics arguing about context-window costs. One commenter shared their own in-house audit skill, noting it was “tuned to different environments” — early evidence that the pattern is already forking.

View on Hacker News →

The Convergence: Why “Security Review” Became a Category in 2026

Cloudflare’s skill didn’t trend in a vacuum. Five forces converged this year to create a market.

1. Real Breaches Forced the Issue

Today — literally today, October 21, 2026 — LiteLLM version 1.107.0 was found compromised on PyPI, carrying a credential stealer and backdoor in a package with 55,000 commits and massive adoption across agent stacks. The top Hacker News comment asks the obvious question: “How could this happen to a project with 55k commits in three years?”

View on Hacker News →

This isn’t isolated. A Mobb.ai audit of 22,511 AI coding skills across four registries (Skills.sh, ClawHub, GitHub, Tessl) produced 140,963 security findings. Thirty-four percent of skills contained vulnerabilities. Twenty-seven percent showed command execution patterns. These are the building blocks agent developers npx install without reading.

Meanwhile, the “Bad Vibes” research presented at Black Hat Asia 2026 found 70+ serious vulnerabilities across 10 major coding agents — Claude Code, Codex, Cursor, GitHub Copilot — using the same handful of bug classes repeatedly. The researchers’ conclusion: every tested agent trusts the model to enforce its own security boundaries, which is roughly equivalent to asking the fox to audit the henhouse.

2. Standards Arrived

OWASP published its Top 10 for Agentic Applications in December 2025 — the first industry-recognized risk taxonomy for agents. It covers ten categories from tool misuse (ASI01) to rogue agents (ASI10), and it gave the ecosystem something it badly needed: a shared vocabulary for what can go wrong.

The Cloud Security Alliance followed with research notes mapping agent risks to existing compliance frameworks. And OWASP itself shipped an updated LLM Top 10 in August 2026 alongside a newly donated Agent Control Standard. Suddenly, when a CISO asks “are our agents secure?”, there’s a checklist that isn’t made up.

3. Academic Research Proved the Attack Surface

Two papers stand out:

• SEVRA-BENCH (CMU, Microsoft, Amazon, Databricks — June 2026) created 1,062 malicious pull requests drawn from real CVE-linked fixes and tested them against 8 LLMs serving as code-review agents, using 15 different social-engineering framings. The findings: review agents can be systematically fooled into approving vulnerability-reintroducing code, with a clear performance gap between closed-source and open-source models.

• Agent Audit (USC — March 2026) built a static analysis tool specifically for agent code, performing tool-boundary taint tracking and MCP configuration auditing. Scanning six open-source agent projects produced 617 findings, with 269 (44%) classified as critical severity.

These aren’t theoretical. SEVRA-BENCH’s attack model — a contributor who reverses a security fix and wraps it in persuasive PR prose — is exactly what happens in real supply-chain attacks.

4. Commercial and Open-Source Tools Shipped

The tooling landscape exploded in 2026:

Tool	What It Does	Who’s Behind It
security-audit-skill	Multi-phase agent audit with adversarial verification	Cloudflare (MIT)
Agent Governance Toolkit	Runtime policy enforcement, agent identity, sandboxing	Microsoft (MIT, public preview)
Agent Audit	Static analysis for agent code — taint tracking, MCP config	USC (open-source)
re_gent	Version control for agent actions — prompts and decisions logged separately from git	Open-source (June 2026)
Mobb Vibe Shield	Skills registry scanning — 140K+ findings across 22K skills	Mobb.ai (commercial)

Microsoft’s Agent Governance Toolkit, released in April 2026, is particularly notable: it’s a seven-package, multi-language (Python, Rust, TypeScript, Go, .NET) framework that intercepts every agent action before execution and enforces policy deterministically. It maps its controls to OWASP Agentic Top 10, NIST AI RMF, the EU AI Act, and SOC 2. Microsoft claims it’s the first toolkit addressing all ten OWASP agentic AI risks — a vendor claim, but the architecture is real.

5. The Attack Sophistication Jumped

The Agentic Security Newsletter by Raphael Bottino frames the core problem: “LLM-based agents collapse the boundary between trusted code and untrusted data, letting adaptive attacks bypass standard guardrails more than 90% of the time.” That thesis is echoed across the security research community.

View on Substack →

It’s not just about buggy code anymore. The Adversa AI October 2026 roundup documents booby-trapped git settings that ran attacker code in Claude Code, Codex, Cursor, and four other agents before any approval prompt appeared. Opening a folder was enough.

A January 2026 systematic analysis of 78 studies found that every tested coding agent is vulnerable to prompt injection, with adaptive attack success rates exceeding 85%. And the Docker security report counts at least ten publicly reported incidents across six tools in 2026 alone.

The attacks have moved from “tricks that work in a lab” to “things that happen to production systems.” That’s what turns a feature request into a product category.

What the Community Is Saying

The timing of today’s Hacker News front page tells the story. Alongside the LiteLLM compromise (465 points, 158 comments), OpenAI published “Patch the Planet” — a post about coordinating global vulnerability response as agents themselves discover critical bugs (154 points, 90 comments).

View on Hacker News →

The juxtaposition is almost too on-the-nose: one story about agents being the target of a supply-chain attack, and another about agents being the tool for finding vulnerabilities. The security-review category exists precisely in the gap between these two realities.

On X, Boris Cherny (@bcherny) — with 4,986 likes and 430K views — captured the practitioner sentiment: “I could not imagine being productive without Claude Code Review. It runs on all of my PRs, and catches almost every bug before it goes in.” This isn’t a security researcher making an argument. It’s a practitioner describing a dependency.

Steve Yegge’s AI Engineer conference talk, “Agentic Security: Permissions, Provenance, and the Agent Supply Chain”, laid out the architectural framework: agents need permission systems, provenance chains, and supply-chain verification as first-class concerns, not afterthoughts bolted on after a breach.

And in the broader context, today’s AI YouTube digest is dominated by a single theme: the model is commoditized; the wrapper is the war. Security review is part of that wrapper — and it’s the part with the most obvious product-market fit, because the cost of getting it wrong is measured in CVEs, not user experience.

The Design Pattern That Matters: Separation of Finder and Verifier

If you take one architectural lesson from Cloudflare’s repo, it’s this: the agent that discovers a potential vulnerability must never be the agent that confirms it.

This sounds obvious. It is not what most teams do. The default pattern in agent-based security review is:

1. Agent scans code
2. Agent finds potential issue
3. Agent evaluates whether the issue is real
4. Agent reports finding

Steps 2 and 3 are performed by the same model with the same context. This is how you get hallucinated vulnerabilities with high-confidence severity ratings — the model’s confirmation bias reinforces its own initial assessment.

Cloudflare’s architecture breaks this:

1. Hunter agent scans code and produces candidate findings
2. Separate verifier agent receives the candidate with no context about the hunter’s reasoning
3. Verifier’s explicit mandate is to disprove the finding
4. Only findings that survive adversarial verification become confirmed
5. Everything else stays needs_validation (with an exact unresolved fact noted) or rejected

The README notes that in test runs, a single scan finds roughly half of what repeated runs with gap-targeting find. That’s the other insight: security review isn’t a one-shot operation. It’s iterative, coverage-driven, and benefits from the same kind of fuzzing mindset that drives traditional security testing.

What This Means for You

If you’re building or deploying coding agents in 2026, here’s what’s actionable:

1. Separate finder and verifier — architecturally, not just procedurally. Don’t have the same agent (or the same model call) both discover and confirm a security finding. Cloudflare’s pattern is a minimum viable architecture. If you’re using Claude Code Review, Cursor, or any agent-based review tool, understand whether it has this separation. Most don’t.

2. Audit your skill supply chain. The Mobb audit found 34% of public skills have vulnerabilities. ThePrimeagen’s poisoned-skill stunt in January 2026 showed that developers install skills without reading them. If you npx skills add anything, you’re running someone else’s instructions with your permissions. Treat skills with the same skepticism you treat npm packages — and we know how well that goes.

3. Map your agent stack against OWASP’s Agentic Top 10. The ten risk categories — from tool misuse to rogue agents — give you a structured checklist that isn’t made up. If your team’s answer to “how do we secure our agents?” is still “we trust the model,” you’re in the 34%.

4. Watch the tooling layer, not just the models. Microsoft’s Agent Governance Toolkit, Cloudflare’s skill, USC’s Agent Audit, and Mobb’s scanner are all targeting different points in the stack. The gap is narrowing fast. Pick the layer that matches your risk profile:

• Pre-commit: Agent Audit (static analysis of agent code)
• Per-audit: security-audit-skill (multi-phase with adversarial verification)
• Runtime: Agent Governance Toolkit (policy enforcement before execution)
• Registry: Mobb / Skills.sh scanners (supply-chain gates)

5. Don’t mistake a skill for a security team. The contrarian view is worth internalizing: a 450-line skill running in CI does not replace humans who understand your threat model. Use these tools to scale your review capacity, not to replace your security function. The agents that found the bugs in the “Bad Vibes” research were the same agents that trusted themselves to enforce their own boundaries.

---

For more on the agent security landscape, see our coverage of the agent supply-chain attack surface, the LiteLLM breach analysis, and the code-quality bottleneck that agent-scale PR volume creates.