Cycode Releases Agentic Code Scanning and Attack Chaining, Post-Mythos Era's Answer to Cost vs. Precision Tradeoff

Agentic Code Scanning in the Cycode platform caught both authorization CVEs in benchmark testing that no rule engine could express. New Attack Chaining capabilities links related findings into the multi-step exploit paths that per-finding severity scoring miss.

SAN FRANCISCO, Sept. 1, 2026 /PRNewswire/ -- Cycode, the leader in Agentic Development Security, today announced Agentic Code Scanning, the fourth dimension of the company's holistic code defense. Rather than shipping a standalone AI scanner, Cycode runs deterministic and agentic code analysis as one system that decides which engine runs where, eliminating the tradeoff between precision, cost, and model choice.

Security teams adopting AI-assisted code review have inherited a set of questions no application security program was designed to answer. Frontier model or an affordable one, every commit or nightly, every repository or only the crown jewels, and what to tell an auditor about which model produced which finding. Each is a symptom of the same underlying problem of having a single instrument and asking it to do every job.

"Nobody got into application security to become a model economist," said Lior Levy, Co-Founder and CEO of Cycode. "Point a frontier model at everything and the bill compounds with every commit, fastest on the code least likely to hide anything. Point rules at everything and you're structurally blind to an entire class of vulnerability. Neither is a holistic strategy. The answer isn't a better model, but a system that decides which one runs where."

Four dimensions, one reconciled result

Cycode runs four dimensions of scanning against the same code, reconciled into a single view of risk:

• Dimension 1: Deterministic SAST. Pattern matching and taint rules in the IDE, MCP, pre-commit, and as a blocking PR gate. Sub-second on a diff and identical every run, making it the only dimension fast and reproducible enough to block a merge on.
• Dimension 2: AI SAST. An LLM generates, updates, and customizes deterministic SAST configurations, so rule-based scanning improves over time while the output stays reproducible.
• Dimension 3: SAST + AI Exploitability. A rule engine finds; an LLM triages, ranks, and argues exploitability before the queue reaches a developer.
• Dimension 4: Agentic Code Scanning. Plans from a threat model, ranks what the model reads per vulnerability class, then disproves every finding.

Dimension 4 sits above the other three, determining what runs, in what order, and on what budget. Cheaper dimensions resolve known vulnerability classes first, so model spend is directed only where rules structurally cannot reach, and no vulnerability class is silently skipped because a budget ran out.

Attack Chaining and remediation at scale

Findings are scored one at a time. They are not exploited one at a time. Agentic Code Scanning links related findings across files into a single multi-step attack path, carrying the data flow from untrusted source to dangerous sink, with Cycode's Context Intelligence Graph grounding each path in real call relationships, ownership, and reachability rather than model speculation.

Because a chain holds only while every link holds, remediation targets the single cheapest link to break rather than every finding in the path.

Those results feed Cycode's Agentic Workflows as a stream of exploitability-qualified events. Teams define a workflow once triggering events, agent action sequence, confidence thresholds and controls, and it runs the moment the event occurs, routing findings to the engineer who wrote the code and returning fixes as reviewable pull requests validated against the original finding. Every run produces an audit trail of what triggered it, what each agent did, and which boundary applied.

Benchmarks validating Cycode's holistic code defense approach

Cycode tested the approach against ten repositories spanning six languages, each pinned to an exact vulnerable commit with six real applications sitting at a published CVE, plus four deliberately vulnerable applications with answer keys the engine was never tuned against.

Against the six published CVEs, the other vendors each returned zero valid catches. Cycode's own Dimension 1 deterministic engine caught three, all injection or traversal bugs with a matchable code shape. Agentic Code Scanning caught all six.

The two authorization CVEs with a broken access control issue in gitea and a middleware authentication bypass in next.js were caught by no rule engine tested, including Cycode's own. An authorization flaw is the absence of a check rather than the presence of a dangerous pattern, which is why broken access control remains the OWASP #1 risk regardless of how many rules ship.

The benchmark also measured the difference between finding a vulnerability and being able to act on it. The taint rule that surfaced mlflow's arbitrary file read fired 573 times across that repository, two of which landed in the CVE file, inside 173 to 701 total findings per repository with no ranking, validation, or root cause. Agentic Code Scanning returned one validated, root-caused finding per CVE.

Results reflect single runs per repository on a reasoning-tier model against a pinned public corpus. Cycode is publishing the corpus and configurations so the results can be independently reproduced.

Agentic Code Scanning is available today. To learn more or request a demo, visit cycode.com.

About Cycode

Cycode is the only Complete Agentic Development Security Platform, securing AI development from prompt to runtime. Unlike standalone models and frontier lab tooling that only run when invoked on their own, Cycode is Always-On™. By unifying control, context, and autonomy in a single platform, with ADLC Security built in, Cycode continuously identifies risk across the AI development lifecycle, governs the AI tools developers use, correlates context across the entire software factory, and deploys and manages agents that prevent risk at AI speed. Cycode secures the top Fortune 500's and is recognized as a Leader by the industry's top analyst firms, including the Gartner® Magic Quadrant™ for Application Security Testing, the Gartner® Magic Quadrant™ for Software Supply Chain Security, and the IDC MarketScape for ASPM. Learn more at cycode.com.

CONTACT: Emily Gallagher, PRSENSE, [email protected] 

SOURCE Cycode