AVRI 为安全漏洞 AI agent 降本 18%-23.7%
研究发现安全漏洞挖掘 AI agent 60.4% 的 token 花在理解代码与推理触发方式上，为此推出 AVRI 工具，通过返回相关代码并保存输入与不安全操作的关联来复用学习成果。
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.
来源：rohanpaul_ai · x.com