An LLM vulnerability scanner that attacks its own findings

What it does

OpenAnt is a vulnerability discovery tool that scans source code for security issues using an LLM pipeline. It breaks work into two stages—detection followed by an attack phase—on the theory that anything surviving both is a genuine flaw rather than a false positive. Released by Knostic under Apache 2, it is a side project from a company whose main business is securing AI agents and coding assistants, not application security tooling.

The interesting bit

Most AI security tools flood you with possible bugs; OpenAnt’s twist is a second stage that attacks its own findings to weed out false positives. The authors are also refreshingly candid about its research-project roots and their lack of interest in competing with OpenAI’s or Anthropic’s own security offerings.

Key highlights

• Two-stage pipeline: detect, then attack to reduce false positives and negatives.
• Supports Go and Python; JavaScript/TypeScript, C/C++, PHP, and Ruby are in beta.
• Requires an Anthropic API key with access to the Claude Opus 4.6 model.
• Free scanning available for open source projects submitted via Knostic’s site.
• Apache 2 licensed; built as a Go CLI wrapping a Python 3.11+ runtime.

Caveats

• Explicitly described as a research project with beta features; the authors warn users to proceed carefully and at their own risk.
• Several supported languages remain in beta.
• Requires an Anthropic API key with access to the Claude Opus 4.6 model, so it is not a fully offline tool.

Verdict

Worth a look for security teams or maintainers who want an LLM-assisted second opinion on their code, provided they are comfortable with API costs and a research-grade tool. Those seeking a mature, fully offline SAST solution should wait.