研究：安全漏洞挖掘 Agent 的 token 花费超六成在理解代码
给做安全 Agent 的人看的：先测 token 都花哪了，再用 AVRI 复用代码理解，Codex 能省 18% 成本。
一项针对 4 个 Agent、共 200 次运行的研究发现，挖掘安全漏洞的 Agent 有 60.4% 的 token 用于理解代码和推理如何触发漏洞。与普通 Agent 对比的直接测试中，仅 24.4% 的省钱方法能在降低成本的同时保持成功率。研究者据此开发了 AVRI 工具，将相关代码集中返回并保留程序输入到危险操作的关联。在 20 个新任务上，AVRI 使 Codex 总成本降低 18.0%，OpenCode 降低 23.7%，成功率和召回率不受影响。
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.
