Rohan Paul (@rohanpaul_ai) · 2026/10/19 15:59:29
AI 安全智能体超六成 Token 耗在代码理解，新工具 AVRI 降本两成
研究发现 AI 安全智能体在漏洞挖掘中 60.4% 的 Token 消耗于代码理解与触发逻辑推理，而非实际执行。针对这一瓶颈，新工具 AVRI 通过优化代码上下文检索与输入-操作关联复用，在不降低成功率的前提下将 Codex 和 OpenCode 的运行成本分别降低 18.0% 和 23.7%。
报道全文原始报道全文
Rohan Paul (@rohanpaul_ai) · 2026-10-19 07
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.
