Open source runs critical infrastructure, and most of it has no security team. AI ships code faster than anyone reviews it, and the gap between a bug landing and a bug being exploited keeps shrinking. In this talk, we cover the scanning architecture we use and the CLI we turned it into. The scanner runs agents that read code, follow imports, trace how functions call each other, and validate the findings to reduce false positives. The scanner is open source under Apache 2.0, and runs on any LLM. One in three of the projects we scanned had a real high or critical bug. We found over 100 zero-days, and we are disclosing them slowly as they get fixed. I walk through a few examples of why each bug happened, why it matters, how AI agents caught it, and why it would have been hard for a human to find.