{"id":6791,"date":"2026-10-30T08:09:52","date_gmt":"2026-10-30T08:09:52","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/?p=6791"},"modified":"2026-10-30T08:09:52","modified_gmt":"2026-10-30T08:09:52","slug":"ai-security-agents-vs-sast-vulnbench-study","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/ai-security-agents-vs-sast-vulnbench-study","title":{"rendered":"AI Security Agents vs. SAST: Snyk Benchmark Finds They Catch Different Bugs"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>The test:<\/strong> Snyk researchers ran their own static analyzer, Snyk Code, against Claude Code, OpenAI&#8217;s Codex Security and the open-source DeepSec on 20 web apps with 108 exploit-verified vulnerabilities.<\/li><li><strong>The result:<\/strong> Snyk Code found 82.4% and Claude Code with Opus 5 at maximum effort 79.3%, a statistically indistinguishable gap. Codex Security pinpointed at most 41.2% at the exact code location, although it often found the right file.<\/li><li><strong>The real lesson:<\/strong> The two leaders catch different bugs. Together they cover 101 of 108 vulnerabilities, while the best AI-only pair reaches 89.<\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">Can an AI coding agent replace a classic static application security testing (SAST) tool? A new preprint from Snyk, &#8220;How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0&#8221; by Liran Tal, Chris Liu, Charlotte Fereday, Sebastian Roth and Brian Clark, argues that the answer is neither yes nor no: the tools split the work by bug type. One caveat comes first. All five authors work at Snyk, the vendor of one of the tested products, and the benchmark was built by that team.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2c What the study shows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The authors compared nine configurations in 180 runs in early September 2026: Snyk Code; Claude Code 2.1.251 with Claude Opus 5 or Sonnet 5 running its \/security-review command; OpenAI&#8217;s Codex Security 0.1.24 with three GPT-5.6 variants (Luna, Terra and Sol); and DeepSec 2.3.7. A finding only counted if it named both the source and the sink of the vulnerability within two lines.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1344\" height=\"768\" src=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/chart-vulnbench-ai-security-agents-recall.webp\" alt=\"Horizontal bar chart of macro recall on 108 vulnerabilities: Snyk Code 82.4%, Claude Code Opus 5 xhigh 79.3%, Opus 5 medium with Snyk MCP 75.2%, Sonnet 5 xhigh 67.0%, Codex Security GPT-5.6 Luna 41.2%, Terra 30.1%, Sol 29.2%.\" class=\"wp-image-6790\" srcset=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-vulnbench-ai-security-agents-recall.webp 1344w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-vulnbench-ai-security-agents-recall-300x171.webp 300w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-vulnbench-ai-security-agents-recall-1024x585.webp 1024w, https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/chart-vulnbench-ai-security-agents-recall-768x439.webp 768w\" sizes=\"auto, (max-width: 1344px) 100vw, 1344px\" \/><figcaption class=\"wp-element-caption\">i10X chart based on data from Tal, Liu, Fereday, Roth &amp; Clark (Snyk, 2026), arXiv:2610.38617, Table 4.<\/figcaption><\/figure>\n\n\n<ul class=\"wp-block-list\"><li><strong>A statistical tie at the top:<\/strong> Snyk Code matched 89 vulnerabilities, Claude Code with Opus 5 at &#8220;xhigh&#8221; effort 85. They disagree on 28 (16 only Snyk, 12 only Opus; McNemar p=0.57). In resampled corpora, Snyk Code ranked first 74% of the time.<\/li><li><strong>Precision differs sharply:<\/strong> Opus 5 xhigh had 74.6% precision (85 of 114 findings matched), Snyk Code 20.9% (89 of 425). But 87% of Snyk&#8217;s unmatched findings were outside the 14 benchmarked classes, mostly 195 hardcoded-credential alerts. Counting only in-scope findings, precision was 69% for Snyk and 81% for Opus.<\/li><li><strong>Different strengths:<\/strong> Snyk Code matched all 11 open redirects, all 6 prototype-pollution bugs and all 16 path traversals, but 0 of 3 authorization flaws (IDOR, mass assignment). Of the 12 bugs only Opus found, 7 were cross-file; of Snyk&#8217;s 16 extra finds, only 3 were. On same-file flows Snyk led 40 to 32 of 46; on cross-file flows Opus led 53 to 49 of 62.<\/li><li><strong>Harness policy matters:<\/strong> Claude Code&#8217;s \/security-review prompt excludes ReDoS and restricts prototype pollution and open redirect. On those 20 bugs Snyk matched 18 and Opus 9. In a supplementary run on 19 apps without that built-in policy, Opus found 16 of these 20 (p=0.016) and 93 of 105 vulnerabilities overall, more than Snyk Code&#8217;s 87, at 0.63 times the cost.<\/li><li><strong>Codex Security finds files, not lines:<\/strong> With GPT-5.6 Sol, it located 80 vulnerabilities at the file level but only 34 at the line level, typically pointing a median of six lines above the sink, such as the function header.<\/li><li><strong>New bugs:<\/strong> The AI tools reported seven real vulnerabilities outside the reference set, all reproduced live. Codex Security reported all seven, Claude Code six and DeepSec three.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u2705 Why it matters: Coverage, not a winner<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security teams are under pressure to replace rule-based scanners with AI agents. This benchmark suggests that dropping either side leaves gaps. Snyk Code plus Opus 5 xhigh covered 101 of 108 vulnerabilities, as many as all seven comparable configurations combined, while the best pair without SAST (Opus 5 xhigh plus Codex Security with Terra) stopped at 89. The paper also shows that a harness prompt can quietly decide which bug classes an agent ignores, so &#8220;the model is weak at X&#8221; is sometimes really &#8220;the prompt told it to skip X&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cost and speed separate the tools even more. Snyk Code scanned all 20 apps in 8 minutes; AI configurations needed 2.4 to 8.9 hours, and DeepSec with Opus 17.8 hours. Per matched vulnerability, that is 5 seconds versus 107 to 942 seconds.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Method in brief<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Corpus:<\/strong> 20 open-source web apps (Go 6, JavaScript\/TypeScript 7, Python 5, Java 2) with 108 vulnerabilities in 14 classes, 62 of them cross-file and 447 flow locations. Each vulnerability has an exploit proof of concept verified by the authors; many were seeded into the apps with AI coding tools.<\/li><li><strong>Scoring:<\/strong> Endpoint rule with source and sink within plus or minus two lines; macro recall averaged over apps; 20 alternative scoring rules as robustness check.<\/li><li><strong>Runs:<\/strong> One run per cell; Snyk Code was byte-identical across repeats. Total known spend was $1,594.08. Code and all run data are public on GitHub.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u2753 What remains open<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Conflict of interest:<\/strong> The authors are Snyk employees, and Snyk Code is the only SAST engine tested. Five apps had appeared in Snyk demos; without them, the result is 74 for Snyk versus 72 for Opus out of 87.<\/li><li><strong>Seeding bias:<\/strong> Seeded bugs may favor either side, as the authors acknowledge.<\/li><li><strong>Single runs:<\/strong> AI agents are non-deterministic, yet each configuration ran once per app.<\/li><li><strong>Codex settings:<\/strong> Codex Security ran in standard, not deep, mode, and covered some apps only partially (7, 6 and 3 apps for the three variants).<\/li><li><strong>Narrow scope:<\/strong> Java coverage is thin, and several apps are intentionally vulnerable demo projects.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udded Context: Coding agents move into security review<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"\/news\/company\/anthropic\">Anthropic<\/a> ships \/security-review as part of Claude Code, and <a href=\"\/news\/company\/open-ai\">OpenAI<\/a> offers Codex Security as a dedicated product. Vendor benchmarks like this one are useful because they publish run data, but they should be read next to independent evaluations. For more on how AI systems are tested, see our <a href=\"\/news\/category\/benchmarks-evals\">Benchmarks &amp; Evals<\/a> coverage and our <a href=\"\/news\/product\/claude\">Claude<\/a> hub.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0\ufe0f What it means for security and platform teams<\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>Run both:<\/strong> A deterministic scanner catches pattern-like bugs (redirects, traversal, prototype pollution) fast and repeatably; an agent adds cross-file and authorization flaws.<\/li><li><strong>Check the harness prompt:<\/strong> Read what a review command excludes before trusting its silence on a bug class.<\/li><li><strong>Budget by match, not by run:<\/strong> Cost per matched vulnerability ranged from $0.47 (Codex Security with Luna) and $0.54 (Sonnet 5) to $1.94 (Opus 5 xhigh), $5.94 (Terra) and $21.92 (Sol). Sol cost 35 times as much as Luna for 11 fewer matches.<\/li><li><strong>Effort beats add-ons:<\/strong> Opus 5 at medium effort matched 81 vulnerabilities without the Snyk MCP server and 80 with it, so the effort setting, not MCP, explained the gap to xhigh.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This article is based on the full text of the preprint (arXiv:2610.38617v1, submitted October 28, 2026), including its appendix. All numbers come from the paper; i10X did not rerun the benchmark. The chart was drawn by i10X from Table 4; the paper is licensed CC BY 4.0. All authors are employed by Snyk, whose product is part of the comparison. AI tools assisted with research and drafting; the selection, fact-checking and final editing were done by the i10X editorial team.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd2d i10x Perspective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The headline from a vendor-authored benchmark would normally be &#8220;our tool wins&#8221;. This one is more interesting: Snyk&#8217;s own data shows Claude Code within statistical noise of Snyk Code and finding bugs the scanner cannot see. The practical takeaway is less about choosing a winner than about layering a fast, deterministic baseline with an agent that reasons across files, and about reading the fine print of every security prompt.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>In Snyk&#8217;s VulnBench 2.0, Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs. Together they reached 101; Codex Security trailed on exact location.<\/p>\n","protected":false},"author":2,"featured_media":6789,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0","paper_url":"https:\/\/arxiv.org\/abs\/2610.38617","pdf_url":"https:\/\/arxiv.org\/pdf\/2610.38617v1","doi":"","arxiv_id":"2610.38617","authors":"Liran Tal, Chris Liu, Charlotte Fereday, Sebastian Roth, Brian Clark","institutions":"Snyk","paper_date":"2026-10-28","venue":"Preprint (arXiv cs.CR, version 1)","peer_reviewed":false,"code_url":"https:\/\/github.com\/snyk-labs\/snyk-vulnbench","data_url":"https:\/\/github.com\/snyk-labs\/snyk-vulnbench","funding_coi":"All authors are Snyk employees; Snyk Code, a Snyk product, is one of the tested tools.","figure_license":"Own chart redrawn from Table 4 (paper CC BY 4.0)","paper_license":"CC BY 4.0","replication":"full","study_models":"Snyk Code; Claude Code \/security-review with Claude Opus 5 (xhigh, medium + Snyk MCP) and Sonnet 5; OpenAI Codex Security with GPT-5.6 Luna, Terra, Sol; DeepSec with Opus 5 and GPT-5.6 Sol","study_sample":"20 open-source web apps (Go, JS\/TS, Python, Java) with 108 exploit-verified vulnerabilities in 14 classes; 9 configurations, 180 runs","footnotes":"","_yoast_wpseo_primary_category":""},"categories":[53,52],"tags":[],"companies":[39,38],"products":[51],"class_list":["post-6791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-benchmarks-evals","category-studies","company-anthropic","company-open-ai","product-claude"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News<\/title>\n<meta name=\"description\" content=\"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk&#039;s VulnBench 2.0; together they caught 101. Codex Security lagged behind.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News\" \/>\n<meta property=\"og:description\" content=\"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk&#039;s VulnBench 2.0; together they caught 101. Codex Security lagged behind.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-30T08:09:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"AI Security Agents vs. SAST: Snyk Benchmark Finds They Catch Different Bugs\",\"datePublished\":\"2026-10-30T08:09:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study\"},\"wordCount\":1153,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-security-agents-vs-sast-vulnbench-study-title.webp\",\"articleSection\":[\"Benchmarks &amp; Evals\",\"Studies\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-10-30T08:09:52+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study\",\"name\":\"AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-security-agents-vs-sast-vulnbench-study-title.webp\",\"datePublished\":\"2026-10-30T08:09:52+00:00\",\"description\":\"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk's VulnBench 2.0; together they caught 101. Codex Security lagged behind.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-security-agents-vs-sast-vulnbench-study-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-security-agents-vs-sast-vulnbench-study-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Illustration: i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/ai-security-agents-vs-sast-vulnbench-study#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI Security Agents vs. SAST: Snyk Benchmark Finds They Catch Different Bugs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News","description":"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk's VulnBench 2.0; together they caught 101. Codex Security lagged behind.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study","og_locale":"en_US","og_type":"article","og_title":"AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News","og_description":"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk's VulnBench 2.0; together they caught 101. Codex Security lagged behind.","og_url":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study","og_site_name":"i10X News","article_published_time":"2026-10-30T08:09:52+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"AI Security Agents vs. SAST: Snyk Benchmark Finds They Catch Different Bugs","datePublished":"2026-10-30T08:09:52+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study"},"wordCount":1153,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp","articleSection":["Benchmarks &amp; Evals","Studies"],"inLanguage":"en-US","dateModified":"2026-10-30T08:09:52+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study","url":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study","name":"AI Security Agents vs. SAST: Snyk VulnBench 2.0 - i10X News","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp","datePublished":"2026-10-30T08:09:52+00:00","description":"Snyk Code found 82.4% and Claude Code with Opus 5 79.3% of 108 bugs in Snyk's VulnBench 2.0; together they caught 101. Codex Security lagged behind.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-security-agents-vs-sast-vulnbench-study-title.webp","width":1344,"height":768,"caption":"Illustration: i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/ai-security-agents-vs-sast-vulnbench-study#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"AI Security Agents vs. SAST: Snyk Benchmark Finds They Catch Different Bugs"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=6791"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6791\/revisions"}],"predecessor-version":[{"id":6796,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/6791\/revisions\/6796"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/6789"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=6791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=6791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=6791"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=6791"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=6791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}