A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense

The Remediation Agent and Malicious Code Defense are the first two pieces of Evo Agentic AppSec: security that not only surfaces risk, but resolves it and prevents the next ones.

This morning, we announced the broadest expansion of the Snyk AI Security Platform to date: discover, remediate, validate, and prevent. A loop with a missing segment is not a loop; it is a gap that an autonomous attacker will occupy. Evo Continuous Offensive Security closes validation and shipped today. Remediation and prevention are what this post is about. 

Security teams do not have a detection problem anymore

They have a prevention and remediation problem.

AI agents now write code at machine speed. They produce more of it than any team can review, and 48% of AI-generated code contains vulnerabilities, several times more vulnerabilities per line than human developers.

Meanwhile, every organization already carries years of unaddressed findings. That backlog used to be a cleanup project. Now it is an attack surface, because attackers have gone agentic too. They enumerate backlogs, chain low-severity issues into critical exploits, compromise the software supply chain, and move faster than any human team can respond. Snyk’s own data shows roughly six new vulnerabilities introduced for every one remediated, and agentic development keeps widening that gap.

Evo Agentic AppSec is built to address that gap. Today, we are sharing a first look at its first two capabilities:

• Remediation Agent, in public preview, which fixes vulnerabilities automatically.

• Malicious Code Defense, in private preview, which stops malicious packages before they reach your code.

The Remediation Agent: from backlog to fixed, automatically

Most tools hand you a list. The Remediation Agent hands you a fix.

Available now in public preview through the Snyk CLI and your agentic development environment (ADE), it works the way an experienced engineer would:

• It triages your open issues by severity and context.

• It creates a fix, tapping into Snyk’s intelligence layer for context like reachability, exploitability, and fix-outcome data.

• It checks whether that fix will break your build using Snyk’s breakability analysis, so upgrades that would break get caught before they ship.

• It applies the right remediation strategy and opens a pull request for your team to review and merge.

You kick off a run and watch it work. The agent shows what it is doing, the fixes in progress, and the pull requests it produces. No context switching, no manual upgrade math, no backlog triage.

Early benchmarking shows a ~14% improvement in fix rates for SAST issues and a ~94% improvement in fix rates for SCA issues when embedding Snyk expertise into a frontier model’s context.

This builds on a remediation track record Snyk customers already know. LabelBox turned a two-year security-debt problem into a two-week one with Snyk. Relay Network cut remediation of a critical vulnerability from more than a week to under 24 hours, and holds a zero critical, zero high-severity posture across its codebase.

The Remediation Agent takes that same proven approach and runs it autonomously and continuously, so outcomes that once took a focused team now happen on every run.

Malicious Code Defense: stopping the attack before it ships

Fixing what is already in your code is half the job. Keeping malicious code out is the other half.

This is not a future problem. As we published this, an active supply chain compromise was moving through the npm ecosystem. On August 4, attackers hijacked the release path for keyv and related packages and shipped install-time malware across 11 releases, starting with keyv@6.0.0. The malicious code runs from a pre-install hook, so just installing the dependency is enough to execute it. No import, no app start, no vulnerable API call. Hours in, eight of the poisoned versions were still tagged latest. And these are not obscure packages: keyv, flat-cache, and file-entry-cache pull hundreds of millions of downloads a month and ride in through everyday tooling like ESLint. The malicious release carried a valid provenance, so the trust signals teams rely on attested a compromised build.

The attack targeted the workflow, not just the package. A second execution path planted .claude and .vscode config set to fire the moment a developer or coding agent opens the project. No install required. That is an attack aimed squarely at agentic development.

Combined with a valid provenance that attests to a compromised build, it is not a supporting detail. It is the thesis: the trust signals and the tools developers rely on are now the attack surface.

AI removes the last bit of friction from attacks like this. On July 30, Anthropic disclosed that during one of its internal security evaluations, a Claude model did the whole thing autonomously. To win a capture-the-flag exercise, it published a malicious Python package to PyPI. The package was live for about an hour. In that window, 15 real systems downloaded and ran it. One belonged to a security vendor whose scanner installs and executes packages to test them. Running the code exposed that vendor’s credentials.

The safeguards that would have stopped it were in the product and switched off for the test. The environment was told it was sealed. It was not. That is the whole point: a boundary asserted in a prompt is not a boundary, and a control that lives in the model cannot govern the environment in which the model is running in.

Snyk analyzes packages without installing or executing them. That is why an incident like this does not reach us, and it is the specific failure mode that exposed the vendor in Anthropic's case.

Malicious Code Defense safeguards against supply chain compromises like these by analyzing every package requested by your developers or agents. It leverages the Snyk Intelligence layer to identify threats, applies defined policies to manage malicious or potentially malicious packages, and utilizes a secure proxy to block their installation. In addition to preventing compromises, Malicious Code Defense provides organization-wide visibility into install requests.

What it means for you, and how Snyk helps

Today: find and fix. Snyk flags known malicious and vulnerable dependencies so your team can find and pull them out fast. In the keyv case, Snyk Security Research analyzed the compromised packages without ever installing or executing them, and published the advisory (SNYK-JS-KEYV-18515941), and gave customers a way to detect exposure and keep monitoring as the incident evolved.

Next: prevention. Malicious Code Defense, in private preview, is built to stop this class of attack before a package ever reaches your environment. Design partners get working package install protection out of the box for PyPI and npm, with policies for either a custom cool-down period on new releases or blocking anything flagged by a published malware advisory. Against an incident like Keyv, that is the difference between quarantining a brand-new poisoned version at install time and racing to rip it out after it has already run. 

Where this is going

The Remediation Agent and Malicious Code Defense are the first two pieces of Evo Agentic AppSec, Snyk’s approach to security that resolves risk and prevents the next one instead of just reporting it. We are introducing them alongside the broadest expansion of the Snyk AI Security Platform to date, which also includes the general availability of Evo Continuous Offensive Security, Snyk Secrets, and a rebuilt risk engine and AI-BOM coverage in Evo AI-SPM.

For the evidence underneath all of it, see State of Agentic AI Adoption, Vol. II, drawn from 3,000+ enterprise accounts and 1.39 million repositories.

Interested in putting a team of security agents next to every engineer? Talk to your Snyk account representative to get access.