安全漏洞智能体 60.4% token 用于理解代码
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should a
安全漏洞挖掘智能体把 60.4% 的 token 花在理解代码和推理如何触发漏洞上，4 个智能体 200 次运行均如此。现有省成本方法效果有限，仅 24.4% 的对比在更低成本下保持成功率。新工具 AVRI 将相关代码成组返回并保存程序输入与不安全操作之间的关联，在 20 个新任务上使 Codex 总成本降 18.0%、OpenCode 降 23.7%，成功率与召回率未下降。
正文
当前显示原文，中文全文译文尚未就绪。
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.