๐—Ÿ๐—ฒ๐˜€๐˜€๐—ผ๐—ป๐˜€ ๐—ณ๐—ฟ๐—ผ๐—บ ๐—ฎ ๐Ÿญ๐Ÿฌ๐Ÿต-๐—ฎ๐—ด๐—ฒ๐—ป๐˜ ๐—ฐ๐—ผ๐—ฑ๐—ฒ ๐—ฎ๐˜‚๐—ฑ๐—ถ๐˜ ๐˜„๐—ผ๐—ฟ๐—ธ๐—ณ๐—น๐—ผ๐˜„

I spent 9.3M tokens on a code audit so you do not have to.

I used a swarm of AI agents to find bugs in a 5,000-line codebase. The system used mappers, finder lenses, deduplication, and adversarial verification.

It worked. I got 32 verified findings and a clean top-10 list. But it cost $46 in API fees. Most of that money was wasted.

Here is what went wrong:

โ€ข Verification was too expensive. 86 of the 109 agents were verifiers. They only caught 2 errors. I paid to re-read code 86 times for a 6% success rate.

โ€ข Mapping was redundant. The finders re-read the code anyway. The map phase was an extra tax.

โ€ข Finders overlapped. There was 30% overlap between the 8 lenses.

โ€ข Formatting wasted money. Using pretty-print JSON bloated every prompt by 40%.

โ€ข Cache reads were high. Every agent re-reads the same files from scratch.

How to fix your AI workflows:

โ€ข Rank before you verify. Find findings, deduplicate them, and rank them. Only verify the top 15. This uses 70% fewer agents.

โ€ข Match paranoia to stakes. Use one verifier for internal audits. Use a full panel only for findings that require real action.

โ€ข Batch verification by file. If 34 findings live in 10 files, make one verifier read the file once. Do not make ten verifiers read the same file.

โ€ข Skip mappers for small repos. If the code is under 10,000 lines, one agent can read it all.

โ€ข Limit your lenses. Use six lenses max. Give each lens clear boundaries so they do not repeat work.

โ€ข Compact your JSON. Do not use extra spaces or new lines in your JSON strings.

โ€ข Use cheaper models for chores. Use frontier models for logic. Use cheap models for deduplication and evidence checking.

โ€ข Set a token budget. Have your orchestrator check the remaining budget before starting new tasks.

The lesson is simple: Fan out to find, but converge before you verify. Breadth is for discovery. Rigor is for the survivors.

Source: https://dev.to/ayoubzulfiqar/lessons-from-a-109-agent-code-audit-workflow-4a5m