AVRI cuts security-agent token costs by up to 23.7%
The takeaway is that cost optimisation for security agents should start with token accounting, since generic compression tricks usually break the reasoning that finds bugs. Teams building vulnerability-hunting agents can instrument their own runs and try AVRI-style code-reuse to cut spend. The measurements on Codex and OpenCode give a concrete baseline to compare against when evaluating cheaper agent pipelines.
A study of 200 runs across 4 AI agents found that security-bug-hunting agents spend 60.4% of their tokens understanding code and reasoning how to trigger bugs. Existing cost-saving methods rarely worked, keeping success at lower cost in only 24.4% of head-to-head comparisons with a plain agent. The researchers built AVRI, a tool that returns related code together and preserves links between program input and unsafe operations. On 20 new tasks, AVRI cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
AI agents that hunt security bugs spend 60.4% of their tokens understanding code and reasoning about how to trigger the bug, so that is where cost cuts should aim.
AI agents hunting security bugs can burn millions of tokens without producing an input that crashes the program. Across 200 runs from 4 agents, 60.4% of tokens went to understanding code and reasoning about how to trigger the bug.
Existing cost-saving methods rarely helped. Only 24.4% of head-to-head comparisons with the plain agent kept success at lower cost.
So they built AVRI, a tool that returns related code together and saves the links between program input and the unsafe operation. On 20 new tasks, it cut total cost by 18.0% for Codex and 23.7% for OpenCode without lowering success or recall.
Before adding generic cost tricks to a security agent, measure where its tokens go and let it reuse what it learned about the code.
