How to Find Code Vulnerabilities with AI Agents Without Breaking the Bank

Recently stumbled upon deepsec from the folks at Vercel Labs. The idea hooked me: developers propose using AI agents for deep security scanning of codebases. Unlike classic static analyzers (SAST) that often spam you with false positives, this one brings "smart" search into play.

The problem with legacy tools is they spot patterns but miss context. Deepsec tries to fix that.

What Is This Thing

Essentially, it's a wrapper for managing scans. The system doesn't just hunt for dangerous code snippets using regex patterns—it feeds suspicious areas to language models for analysis. The creators honestly warn that scanning a large repository at full intensity could get pricey. The README mentions costs in the thousands, even tens of thousands of dollars.

The numbers are intimidating, but Vercel's reasoning is straightforward: a single missed critical bug in production could cost the business far more.

How the Process Works

The tool operates in stages. First, a quick pass runs without neural networks—command scan simply identifies potentially problematic areas using matchers. This phase costs nothing.

The real magic happens with command process. That's when agents take over. They take the first stage's findings and start unraveling them. The agent determines whether there's actually a vulnerability or if it's a false alarm. For massive projects, execution can be distributed across workers.

Features I Liked

Deepsec has several architectural decisions that reveal experienced engineers behind it.

First, the system can resume from where it left off. If your internet drops or you run out of funds in your OpenAI/Anthropic API balance, you don't need to start over. State is saved locally in folder .deepsec.

Second, there's a revalidation mechanism. Command revalidate checks the Git history: if you've already fixed a vulnerability, the tool will notice and won't flag it again.

Third, there's contextual awareness. Rather than feeding the entire repository to the model (which would be prohibitively expensive and inefficient), deepsec asks you to prepare a condensed project brief—file INFO.md. You describe the specifics: how authorization works, what middleware is used, where configs are located. This helps the agent avoid asking obvious questions and reduces errors.

How to Run It Yourself

To get started, a standard npx is sufficient:

npx deepsec init
cd .deepsec
pnpm install

Next, configure your access keys. The team recommends using Vercel AI Gateway, but you can also pass direct Anthropic or OpenAI tokens. The key is to keep limits in mind. A standard Claude Pro subscription won't cover a full scan—you'll want to budget for API access from the start.

For checking changes in a specific pull request, there's a convenient flag:

pnpm deepsec process --diff

This saves significant time and money since only the modified files are analyzed.

Technical Side and Security

It's worth noting that deepsec itself has shell access. You run code that controls an agent with command execution rights. To avoid getting hit by malicious code in project dependencies, there's a Vercel Sandbox mode. In this case, work happens in isolated micro-VMs, and your API keys stay outside and can't be stolen.

Who This Is For

For small pet projects, deepsec is overkill. But if you're working in enterprise with massive legacy codebases where security matters more than saving a few hundred dollars on tokens, it's worth trying. It's especially good at finding logical flaws in authentication or complex vulnerability chains that a regular linter would never catch.

Should you rush to implement this in every CI/CD pipeline? Probably not. But as a tool for periodic deep codebase audits, it looks like a very sound approach to AppSec in 2024.