Study: 60.4% of security agent tokens go to code understanding; AVRI cuts costs up to 23.7%
rohanpaul_ai · x · 2026-10-19
Rohan Paul highlights a study ("Where Do the Tokens Go?") profiling token spend in LLM vulnerability-discovery agents.
- Across 200 runs from 4 agents (Codex, OpenCode, Cybench, EnIGMA), 60.4% of tokens went to code understanding and reasoning about how to trigger the bug
- Existing cost-saving methods rarely helped: only 24.4% of head-to-head comparisons kept success at lower cost
- The authors built AVRI, an agent-centric interface that returns related code together and preserves links between inputs and unsafe operations. On 20 new tasks it cut total cost 18.0% for Codex and 23.7% for OpenCode without hurting success or recall
- Takeaway: measure where tokens go before adding generic cost tricks, and let agents reuse what they learned about the code
More from coding & agent
- Princeton and Google paper: 4B decision model cuts agent costs by up to 89% — rohanpaul_ai · 2026-10-19
- Neo4j reduces graph embedding generation to a single API call — JeremyCMorgan · 2026-10-19
- DeepSeek drives Blender solo: full modeling-render run costs ~$1.7 and 1.58M tokens — teortaxesTex · 2026-10-19
- Developer notices Codex seems to default to DuckDuckGo for web search, verifies with script — thomasahle · 2026-10-19
- Two agent incidents, one root cause: no gate between proposal and execution — r0b3rtb · 2026-10-19
- Agent builds aquarium layout simulator in 45 minutes, iterating on request — CurieuxExplorer · 2026-10-19