The Coding Agent Became a Security Scanner This Week. It's Also the Thing Being Scanned.

Claude Security, Cisco Antares, and Gemini Cyber all moved vulnerability hunting inside the agent loop in 48 hours. The catch is that the scanner runs with your permissions, and the repository it reads can bite back.

Three vendors shipped the same idea inside two days, and none of them called it the same thing. Anthropic put a multi-agent vulnerability scanner inside Claude Code. Cisco open-sourced small models that point a reviewer at where the bugs live. Google fine-tuned a Gemini variant to find and fix flaws. The pitch across all three is identical once you strip the branding: stop treating security as a stage that happens after the code, and run it with the same kind of model that wrote the code, in the same loop.

The strangest part of the week is buried in Anthropic's own documentation. There's a section for the Claude Security plugin titled "Scan repositories you don't trust," and it exists to tell you, in plain terms, that the scanner adds no isolation of its own. Read that twice. The tool built to hunt for attacks in a codebase will happily run whatever the codebase tells it to.

Security stopped being a separate stage. That's the good news and the problem.

For years the security pass lived somewhere else. You wrote code, pushed it, and a scanner in CI told you what you'd done wrong an hour later. What shipped this week collapses that distance. The scan now runs inside the session where you're already working, reading the same files with the same model, and it can hand you a patch before you commit.

That's a real change, and for code you own it's a good one. Catching an injection flaw in a branch diff before it merges beats finding it in production. The value is obvious enough that three companies converged on it in the same 48 hours.

Here's the counter-signal, and it has teeth. Every one of these scanners runs inside a session, and it inherits whatever that session can do. The same week the tools learned to hunt vulnerabilities, a WhatsApp MCP server CVE and a reported Claude Code sandbox escape both fired through the exact repositories agents are told to read. The agent is now the scanner and the scanned surface at once. Point it at a repo you don't control, and you may be running the attacker's setup instead of auditing it.

What the Claude Security plugin actually does

The plugin adds one command, /claude-security, and it does something more careful than a single-pass linter. It runs a team of agents through a repository: one maps the architecture into components, one builds a threat model per component with entry points and trust boundaries, others hunt for specific vulnerability classes, and a final panel reviews every candidate before anything reaches the report.

That review is the part worth understanding. A finding only lands in the report after three independent verifier agents vote on it across three lenses: reachability, impact, and defenses. It needs two of three to clear, and a non-unanimous panel caps the stated confidence at medium. The tally is computed by the renderer, not asserted by the model, so the report tells you exactly how thoroughly each finding was checked. Results write to a timestamped directory in your repo, with a revision stamp tying every report to the exact commit it scanned.

The plugin never applies a patch on its own. It drafts fixes in a scratch copy, has a second agent review each one against your tests, and drops .patch files you apply yourself with git apply, one per pull request. It needs Claude Code v2.1.154 or later on a paid plan, plus python3 on your path, and every scan counts against your usage. It is deliberately not a replacement for static analysis or dependency scanning. It reasons about code the way a human researcher would, which is a complement to the deterministic checks, not a substitute.

All of that is genuinely well built. And then there's the section that names the catch. A scan runs in your session, under your permissions, and adds no isolation. The repository's committed .claude/ settings, its hooks, and its CLAUDE.md apply exactly as they would in any other session. The scanner treats the repo's text as data under review rather than instructions, but Anthropic says outright that this "isn't a defense against a hostile repository." Their fix is to sandbox the whole session with sandbox-runtime before you scan anything you don't fully trust (Claude Security docs).

Cisco Antares is the narrow, local version of the same bet

Cisco's Antares family takes the opposite shape and lands in the same place. These are small security models with one job: given a vulnerability description, find the files in a codebase most likely to contain it. Antares-350M and Antares-1B are open-weight on Hugging Face now, with a 3B coming. They don't fix anything. They output a ranked list of suspect files plus the terminal trace that got there, so a human can start triage from a short list instead of a whole tree.

The numbers are the argument. On Cisco's own Vulnerability Localization Benchmark, a 500-task set drawn from 290 repositories across 147 CWE categories with CVE identifiers on 78% of entries, Antares-1B scores 0.209 File F1 and beats GLM-5.2 at 753 billion parameters, which manages 0.186. It does that at under a dollar per evaluation against roughly $12.50 for GLM-5.2 and about $141 for GPT-5.5 (MarkTechPost). Because it runs locally, your source never leaves the building, which is the whole reason a university or a small security team would touch it. The benchmark is Cisco's own, so weigh it against your own code before you trust the ranking.

Google's contribution is the tell that makes the trend legible. Gemini 3.5 Flash Cyber is fine-tuned to find and fix vulnerabilities, and Google restricted it to governments and trusted partners under a limited pilot instead of shipping it to everyone. A vendor built a dedicated vulnerability model and then decided most builders shouldn't have it. That gate is a statement about how they read the offense-defense balance: a model good enough to find flaws for you is good enough to find them for someone else.

The pattern, and the repositories that break it

Put the three together and the direction is one thing. The expensive, centralized security stack is being pushed down into tools you run yourself, driven by the same class of model that writes your code. In-loop scanning, local vulnerability models, reviewed patches you apply by hand.

Now read that next to what else shipped. A WhatsApp MCP server CVE disclosed July 20 (CVSS 7.7) let attackers send unauthorized messages and exfiltrate files from versions before v0.2.1. It arrived alongside a reported Claude Code sandbox escape spanning versions 2.1.38 through 2.1.162, where worktree handling plus symlink manipulation allowed code execution outside the sandbox through a malicious repository carrying prompt-injection content. Both of these are secondary security-research coverage rather than confirmed vendor advisories, so treat the version ranges as reported (Adversa AI roundup). The shape is what matters: the tools designed to read untrusted code are being attacked through the untrusted code they read.

Put this into practice

Start where the risk is lowest and work outward.

Scan code you own first. Install with /plugin install claude-security@claude-plugins-official, run /reload-plugins, then /claude-security and point it at a branch diff before you merge. Read the report, pick the findings you believe, and apply patches yourself with git apply, one per pull request. This is the ten-minute first win, and nothing about it touches code you don't trust.
Sandbox before you scan anything third-party. The moment you point a scanner at a dependency or an unfamiliar repo, you are running its .claude/ settings and hooks in your session. Wrap the session in sandbox-runtime first. Treat scanning someone else's code as equivalent to running it, because that's what it is.
For code that can't leave the building, reach for Antares. Pull Antares-1B from Hugging Face, hand it a CWE description, and let it narrow a large repo to a short list of suspect files for a human to inspect. It localizes, it does not remediate.
Keep your deterministic scanners. None of this replaces static analysis or dependency scanning. The model reasons like a researcher and misses in different places than a ruleset does. Run both.

Where this bites

The honest limits are specific. The Claude Security scan is nondeterministic, so two runs over the same code can surface different findings; run it regularly rather than once. It costs tokens and needs a paid plan and a recent Claude Code. It adds no isolation, which is not a footnote but the central caveat. Antares only points, it doesn't fix, and it's tuned for known vulnerability classes rather than general reasoning. Gemini Cyber is the one you probably can't get, by design. And the two exploits that anchor the counter-story are researcher reports, not vendor confirmations, so hold them loosely until each vendor speaks.

There's a quieter limit under all of it. A scanner that runs with your permissions in your session has no trust boundary between itself and a hostile repo except the one you build around it. The tool tells you this. Most people running it fast, inside a normal session, on a dependency they cloned an hour ago, will not.

What's actually worth betting on

The loudest thing this week is the one that didn't ship. Prediction markets had Claude Opus 5 at 88% to launch on July 23, and Anthropic stayed silent on the model and released a security plugin instead (BigGo Finance). Read that as a signal about where the interesting work has moved. The frontier-model cadence is cooling while the tooling and security layer around the models speeds up.

So here's the question to sit with. If the scanner and the attacker can run in the same session, with the same permissions, reading the same file, what is the actual boundary between auditing code and executing it? Right now the answer is a sandbox you have to remember to turn on. Go run /claude-security on a repo you wrote, watch the panel vote, and then ask yourself whether you'd have thought to wrap the session before scanning the next one you didn't.

Sources: Claude Security docs, Cisco Antares blog, MarkTechPost on Antares, TechCrunch on the Gemini 3.6 wave, MarkTechPost on the Claude Security plugin, Adversa AI MCP security roundup.