TLDR: SecureVibes has launched an innovative open-source AI tool that utilizes Anthropic’s Claude AI, through a multi-agent system, to automatically detect security vulnerabilities across 11 programming languages. Designed for the rapid development environment of “vibecoding,” this Python-based scanner offers professional-grade security analysis, outperforming single-agent AI and traditional SAST tools in self-tests, while prioritizing privacy and offering cost-effective scanning.
In a significant advancement for software security, SecureVibes, a new open-source AI tool, has been introduced to address the growing security risks in the era of “vibecoding”—where developers rapidly build applications using artificial intelligence. Developed by Anshuman Bhartiya and released in October 2025, SecureVibes leverages Anthropic’s Claude AI through a sophisticated multi-agent system to autonomously identify vulnerabilities in codebases across 11 programming languages.
This Python-based scanner aims to democratize professional-grade security analysis, making it accessible even without deep security expertise. At its core, SecureVibes operates with five specialized AI agents that mimic a human security team’s collaborative approach.
The Multi-Agent Architecture:
Assessment Agent: Maps the codebase architecture, generating a `SECURITY.md` file with crucial details like data flows and dependencies.
Threat Modeling Agent: Applies the STRIDE methodology to pinpoint potential threats, outputting a `THREAT_MODEL.json` file.
Code Review Agent: Scrutinizes the code against identified threats, validating issues and producing a `VULNERABILITIES.json` file with specific file paths and line numbers.
DAST Agent (Optional): Performs dynamic testing on a running application via a target URL, adding exploitability checks through Claude Agent Skills.
Report Generator: Compiles all findings into actionable reports, available in formats such as Markdown or JSON.
SecureVibes supports a comprehensive list of 11 languages, including Python, JavaScript, TypeScript, Go, Ruby, Java, PHP, C#, Rust, Kotlin, and Swift. The tool intelligently detects project types and automatically excludes irrelevant directories, such as `venv/` for Python or `node_modules/` for JavaScript projects, ensuring efficient scanning of mixed-language codebases.
In self-tests, SecureVibes demonstrated remarkable effectiveness, uncovering 16-17 vulnerabilities within its own codebase. This figure is four times higher than what a single-agent AI like Claude Code identified, and significantly, traditional rules-based scanners found zero vulnerabilities in the same tests. This context-aware methodology is crucial in reducing false positives by demanding concrete evidence for each detected issue.
Regarding operational costs, scans using the Sonnet model are reasonably priced at approximately $2-3 per scan, with the Opus model offering deeper analysis at a premium. Privacy is a key consideration; only code and relative paths are transmitted to Anthropic, with no sensitive information like secrets or absolute paths ever shared. Users are encouraged to review Anthropic’s privacy policy before scanning highly sensitive code.
Also Read:
- Microsoft Research Unveils BlueCodeAgent: AI-Powered Defense for Secure Code Generation
- AgentLISA Achieves #4 on x402scan Leaderboard, Bolstering AI Security for the Autonomous Agent Economy
SecureVibes is available as an open-source project on GitHub under the AGPL license and can be easily installed via `pip install securevibes`. It also provides a Python API for seamless integration into CI/CD pipelines, facilitating automated security checks. The tool is continuously evolving, with recent enhancements including DAST validation and advanced testing capabilities. As AI-driven development continues to accelerate, SecureVibes is poised to play a vital role in bridging the security gap, enabling developers to deliver safer applications more quickly.
