Four major labs—Anthropic, OpenAI, Cloudflare, and Google—released AI security agents in 2026 that converge on a shared architecture: a discovery agent hunts vulnerabilities, a separate verifier independently attempts to disprove each finding, and only validated results proceed to patching. This pattern addresses the high false-positive rates of earlier LLM scanners, which Google reported below 7% true-positive. Anthropic's Claude Security runs as a plugin inside Claude Code sessions, requiring no separate API key and consuming the user's existing plan limits; it outputs SARIF 2.1.0 reports and .patch files without auto-committing. OpenAI's Codex Security provides an Apache-2.0 CLI/SDK (@openai/codex-security) with GitHub Action support, SARIF/JSON/CSV export, and Linear integration, though the backend scanner remains in limited beta for approved customers and supports OpenAI, Bedrock, OpenRouter, and Fireworks models. Cloudflare's MIT-licensed Security Audit Skill operates on any coding agent with parallel sub-agents and tool use, enforcing a six-phase audit with independent re-verification; it requires an OS-enforced sandbox for execution, otherwise findings remain in "needs_validation." Cloudflare reported 20,799 raw candidates reduced to 7,245 actionable findings across 145 repos, with recon improvements cutting first-pass rejection from 40% to 11%. Google's Apache-2.0 Mantis adds sandboxed bug reproduction—from static exploits to unit tests—and an adversarial patch verification loop, plus hierarchical summarization cutting token overhead over 85%. All four tools separate discovery from validation, with Cloudflare explicitly using different models for each phase. Additional 2026 entrants include Visa's VVAH, Hadrian's OpenHack, Vercel's deepsec, and commercial platforms from AWS, Snyk, Semgrep, Microsoft, Wiz, and Theori, the latter discovering CVE-2026-31431.