deepsec: An Open-Source AI Agent for SAST, by Vercel

On May 4, 2026, Vercel released deepsec, an open-source security harness that scans codebases using Claude Opus 4.7 and GPT-5.5. The headline number isn't trivial: a false-positive rate around 10-20% where traditional SAST tools (Snyk, Semgrep, GitHub Advanced Security) typically run 60-80%, and an execution model that runs on your own stack — laptop, on-prem machine, or Vercel Sandboxes for parallelization.

That's a strong signal for DevSecOps teams that quietly uninstalled their SAST scanner because nobody read the reports anymore. The code lives on GitHub, runs on an existing Claude or Codex subscription — so no extra API key sprawl to manage.

Why SAST plateaued

Static application security testing has been in the engineering toolbox for 15 years. The well-known problem: noise. On a mid-sized monorepo, Snyk or Semgrep easily surfaces 5,000 findings, 80% of them false positives because the tool lacks context (it doesn't know that an input parameter was already sanitized upstream). Developers learn to ignore the report; the critical findings drown; security becomes checkbox theater.

Reasoning-heavy agentic models change the equation. An LLM that can trace a data flow across 12 files, recognize that sanitization happens somewhere a regex won't ever catch, and judge the relevance of a finding addresses the historic SAST defect head-on. Inference cost remains the constraint, but at $1.50 to $7.50 per million tokens (for Mistral Medium 3.5 for instance) or through a Claude subscription, the math holds for a weekly scan of a 200,000-line repo.

The five-step architecture

deepsec runs its audit as a sequential pipeline, each step with a clear responsibility:

Scan

Regex-based identification of security-sensitive files: auth handlers, user-input parsing, dynamic SQL queries, cryptographic code, deserialization points. It's deliberately coarse — the goal is to narrow the surface the agent will investigate in depth, not to judge.

Investigate

The agent (Claude Opus 4.7 or GPT-5.5) traces data flows across the retained files. It checks for existing mitigations, examines auth conditions, builds an understanding of invariants. This is the most token-heavy step — typically several hours of compute on a large repo.

Revalidate

A second pass strips the false positives. The agent re-reviews each finding and judges whether it holds up in the global context. That double-judgement is exactly what drops the FP rate from 60-80% to 10-20%.

Enrich

Findings get Git metadata: who wrote the offending line, when, in which commit. Useful for routing the ticket directly to the right dev rather than dumping an anonymous global report.

Export

Formatting into actionable tickets (Linear / Jira / GitHub Issues) with severity and context. That's the detail that separates a PDF report gathering dust from an incident workflow that actually runs.

The models under the hood

deepsec doesn't ship a proprietary model. It plugs into Claude Opus 4.7 in max effort or GPT-5.5 in xhigh reasoning, two of the most capable models for long-reasoning tasks today. You bring your own API key or existing Claude / Codex subscription; the agent handles the rest.

That portability is actually a strong architectural choice. Rather than coupling the tool to a model vendor, Vercel bets on the underlying model being the quality lever — and that quality improves month over month. In six months, plugging in Claude Opus 4.8 or Mistral Medium 4 mechanically improves results without touching deepsec's code.

On runtime, two modes: single machine on a powerful laptop or dedicated server (count several days for a large repo), or fanout on Vercel Sandboxes with 1,000+ parallel executions for an audit in minutes. The second option makes sense in CI: trigger a scan on every meaningful PR, with cost absorbed by the Sandboxes plan.

Measured performance

The numbers Vercel and early public users share line up:

• False positive rate: 10-20% (measured on Vercel's internal monorepos)
• Real critical findings identified on "subtle edge cases in auth conditions" — exactly the kind of bug classic SAST misses
• Scaling confirmed up to 1,000+ concurrent Sandboxes on Vercel production scans

Two quotes from early public users who aren't Vercel:

"deepsec's scans have been the most thorough, with most findings, and good true-positive rate." — James Perkins, co-founder Unkey

"deepsec is the first tool that's surfaced the kind of issues we'd actually want a security engineer to flag." — Steven Tey, founder dub.co

These are CTOs of small teams, so calibrate accordingly, but the qualitative signal is consistent.

A worked example: scanning a 200K-line monorepo. Take a representative shape: a 200,000-line backend monorepo with 35 active developers, mixed Python and TypeScript, three years of history. A traditional SAST tool would surface around 4,500 findings on first run, with maybe 600 true positives buried in the noise.

Run deepsec via Sandboxes fanout: scan completes in roughly 12-18 minutes elapsed time. Token cost lands in the $40-80 range using Claude Opus 4.7 at the published API rates. Findings drop to roughly 350-400, with around 300 holding up under independent review. The git enrichment routes 80% of those tickets to the four developers actually responsible for the offending paths, which collapses triage time from days to hours.

That's the shape that turns SAST from wishful theater into a real CI gate: bounded cost, actionable output, and focused inspection requests rather than a 4,500-row CSV nobody opens.

What this actually changes for AI teams

Three concrete implications for anyone running security or code quality in production:

1. SAST becomes a budgetable agentic workflow. With predictable token cost (a complete scan runs a few million tokens, so $30-100 per run on Claude Opus agents, less when self-hosting Mistral), it becomes reasonable to wire SAST into the weekly CI. That's the inverse of current practice where the scan runs off-line and nobody looks — here, marginal cost is low and findings are actionable.

2. The context-aware layer pulls findings back into circulation. When a report drops from 5,000 alerts to 100 findings of which 85 are true, developers start reading again. That's a behavior change, not just a technical gain. Teams that gave up on SAST out of fatigue can reintroduce it at low adoption cost.

3. Open source + on-prem-runnable = compatible with sensitive contexts. Banking, defense, healthcare, critical infra — sectors where shipping source to a US SaaS is forbidden. deepsec running on your Kubernetes cluster with your own Claude API key (or a self-hosted model like Mistral Medium 3.5) resolves that friction. It's also what lets you combine the scan with the AI Act compliance stack European teams have to stand up before August 2.

For a 30-developer team that abandoned Snyk two years ago, the right move now: clone the repo, plug in a Claude API key, and run a scan on the main branch. The output will be more useful than what the previous scanner produced in two years, at comparable resource cost. If the findings land, industrialise via Sandboxes or in-house cluster; if not, you've spent two hours.

TL;DR

• deepsec released by Vercel on May 4, 2026, open source on GitHub (vercel-labs/deepsec)
• 5-step pipeline: Scan → Investigate → Revalidate → Enrich → Export
• Models: Claude Opus 4.7 (max effort) or GPT-5.5 (xhigh reasoning), via existing subscription
• False positives ~10-20%, vs 60-80% for traditional SAST
• Scaling: solo laptop (multi-day) or Vercel Sandboxes in parallel (1,000+)
• On-prem compatible, so relevant for banking, defense, healthcare, and the AI Act compliance stack

Industrialising AI agents? SeedVision offers 3-5 day AI audits and 15-30 day production rollouts. See the packages or book a 30-min call.

Cover photo: Photo by Markus Spiske on Unsplash.