Code execution via eval() on model output
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
Pick Cursor Bugbot if your team works in Cursor and wants a check on every pull request. Pick OhMyBug if you want a bug hunt before you merge or push: $4 when it finds a bug, $0 when the code is clean.
Bugbot A charge for each review
10 of 10 reviews charged
OhMyBug Charged only when a review finds a bug
3 of 10 reviews charged
| Topic | OhMyBug | Bugbot |
|---|---|---|
| You pay for | A review that finds a medium or worse bug: $4. A clean review: $0 | Each review: $1.00 to $1.50 on average, by PR size and complexity |
| Where it reviews | Any change your coding agent can see, with or without a pull request | Pull requests on GitHub, GitLab, Bitbucket, Azure DevOps, and Origin |
Bugbot facts as of November 10, 2026. The sourced facts are in the full table.
OhMyBug #1 on ReviewBench · snapshot October 25, 2026
Our precision is lower than Cursor on ReviewBench. Each finding is checked by your own Claude or Codex, against your repository, before you act on it.
Cursor #32 on ReviewBench · snapshot September 27, 2026
Grounded scores from review-bench.ai, pulled November 11, 2026. "Cursor" is the leaderboard's name for Cursor's reviewer.
eval() on model outputOhMyBug caught it when we replayed the change that introduced it. In the code it lived ~7 months before the fix.
CVE-2026-35002 · advisory published June 30, 2026
OhMyBug caught it when we replayed the change that introduced it. In the code it lived ~14 months before the fix.
GHSA-mchm-gjx6-7h55 · advisory published September 24, 2026
From the replays on our home page; advisories checked November 10, 2026.
A review costs $4 when it finds a medium, high, or critical bug. Clean reviews, minor-only reviews, and findings your agent rejects cost $0. Your first bug-finding review is free. How billing works
On CI billing a hunt bills when it finds a medium-or-worse bug, checked or not (CI billing).
Cursor says the average Bugbot review costs $1.00 to $1.50, depending on PR size and complexity. Source
The hunt runs in our cloud. Then the coding agent on your machine checks every finding against your repository and marks it REAL or NOT REAL, with a reason. You approve the verdicts.
$4 for a fast review that finds a bug. A deep hunt runs only when you choose it, and the offer shows the price first: $12, or $24 on a very wide change. One bug or ten costs the same.
OhMyBug is ranked #1 on open ReviewBench (review-bench.ai). See real bugs it found this week in the Bugarium.
Cursor Bugbot facts as of November 10, 2026, quoted from its public pages
| Topic | OhMyBug | Bugbot |
|---|---|---|
| Price | Fast review: $4 when it finds a medium or worse bug, $0 when clean. A deep hunt runs only when you choose it: $12, or $24 on a very wide change. | The average review costs $1.00 to $1.50, depending on PR size and complexity. Dry-run reviews are billed like normal reviews. Bugbot docs |
| Where it reviews | Any change your coding agent can see: a branch, uncommitted changes, recent commits, or a folder with no git. In CI, the OhMyBug CLI. | Pull requests on GitHub, GitLab, Bitbucket, Azure DevOps, and Origin. docs |
| Training on your code | Submissions are not used to train models. | With Privacy Mode on: "we will not train on your data." security |
It can be, if you would rather pay per review that finds a bug. Cursor says the average Bugbot review costs $1.00 to $1.50, depending on PR size and complexity. OhMyBug charges $4 for a review that finds a medium or worse bug and $0 for a clean one. Some teams use both: a reviewer on every pull request, and a bug hunt before a risky merge.
Yes. OhMyBug has no seat fee and no monthly plan. You add credit, and a review costs $4 when it finds a medium, high, or critical bug. Your first bug-finding review is free, with no card.
No, per review. One bug or ten costs the same $4. A clean review, or one with only minor findings, costs $0.
The review gives each finding a severity and a failure scenario. Your coding agent checks every finding in your repository and marks it REAL or NOT REAL, and you approve the verdicts. Findings it rejects cost nothing. On CI billing there is no confirm step. The full rules are in the FAQ.
No. Your coding agent can send a branch, uncommitted changes, your last commits, or a folder with no git. If you commit straight to main, ask it to hunt bugs in your last few commits.
The diff and the files the reviewers ask for go to our cloud sandbox. Submitted files are removed from the database after the sandbox receives them. Run transcripts are kept for 7 days after a completed review and 30 days after a failed one. Submissions are not used to train models. Details: How it works.
Cursor's Bugbot page says the average review costs $1.00 to $1.50, depending on PR size and complexity, as of November 10, 2026.
Claude Code:
claude plugin marketplace add OhMyX-AI/ohmybug-plugin
claude plugin install bughunter@ohmybug
Codex (the update runs last):
codex plugin marketplace add OhMyX-AI/ohmybug-plugin
codex plugin add bughunter@ohmybug
codex mcp login ohmybug
codex update
Then say "hunt bugs" in your project. First bug-finding review free. No card.
Start free review →Cursor Bugbot and other product names on this page belong to their owners and are used only to identify those products. Facts about Cursor Bugbot are quoted from its public pages as of November 10, 2026 and may have changed since; follow the source links for the current terms.