[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-for-ai-security-agents-the-client-beats-the-model":10,"sections":48},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":38,"tags":39,"sources":43,"feedback":47,"feedback_at":22,"cost_usd":47,"total_tokens":47},3772,"for-ai-security-agents-the-client-beats-the-model","For AI Security Agents, the Client Beats the Model","A new study using HexStrike-AI as a testbed found that the client driving an LLM matters more than the model itself in security tool orchestration.","A new study on AI-driven security tool orchestration found that the client software running the model matters more than the model itself.\n\nResearchers used HexStrike-AI, an open-source orchestrator exposing more than 150 tools, as their testbed. They ran 774 trials across 86 picoCTF challenges, testing three tool-access regimes and three model-and-client configurations, then diagnosed failures and applied targeted fixes. The overall solve rate rose from 55.4% to 72.0%, with every configuration improving significantly. The biggest lever turned out to be the client: swapping the software driving a fixed DeepSeek model produced a 2.1x performance gap between two clients running the same underlying model.\n\nMost AI security coverage fixates on the underlying model: which lab built it, how recent the training cutoff. This study shifts the frame. The orchestration client, the layer that decides what tools to call and in what order, may matter more than the model it drives.\n\nThe researchers note that the fixes were tuned on the same challenges they were evaluated on, and the client effect is demonstrated for one model only, so its generality, in their own words, remains a hypothesis.","[\"ai\",\"security\",\"llm\",\"open-source\"]","2026-07-07T04:00:00.000Z","2026-07-07T08:11:14.690Z","2026-07-07T08:11:17.483Z","published",null,[24,30,34],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The dek names 'HexStrike-AI' but the source consistently uses 'HexStrikeAI' (no hyphen) — flag as a potential brand name typo that must be verified and corrected consistently throughout.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The source's headline and abstract spell the tool 'HexStrike-AI' (with a hyphen), but the article body and dek consistently use 'HexStrikeAI' (without a hyphen) — the brand name spelling must be verified and used consistently throughout.",{"id":35,"reviewer":26,"round":36,"reason":37,"status":29},"editor-r3",3,"The article body correctly uses 'HexStrike-AI' (with hyphen) matching the source headline, but the dek still uses 'HexStrikeAI' (without hyphen) — the spelling must be consistent throughout; also, the headline uses an em-dash style that reads as a working placeholder rather than a finished publication-ready headline.","security",[40,38,41,42],"ai","llm","open-source",[44],{"name":45,"url":46},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.02873",0,{"sections":49},[50,54,58,63,68,73,78,83,88,92,97,101,106,111],{"name":51,"slug":40,"count":52,"latest_published_at":53},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":55,"slug":38,"count":56,"latest_published_at":57},"Security",294,"2026-07-15T19:59:48.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":67},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":69,"slug":70,"count":71,"latest_published_at":72},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":18},"Dev Tools","dev-tools",59,{"name":93,"slug":94,"count":95,"latest_published_at":96},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":98,"slug":99,"count":95,"latest_published_at":100},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]