A First Look at Agentic AppSec: Agentic Remediation and Malicious Code Defense

The Remediation Agent and Malicious Code Defense are the first two pieces of Agentic AppSec: security that not only surfaces risk, but resolves it and prevents the next ones.

Security teams do not have a detection problem anymore

They have a prevention and remediation problem.

AI agents now write code at machine speed. They produce more of it than any team can review, and current models introduce several times more vulnerabilities per line than human developers.

Meanwhile, every organization already carries years of unaddressed findings. That backlog used to be a cleanup project. Now it is an attack surface, because attackers have gone agentic too. They enumerate backlogs, chain low-severity issues into critical exploits, compromise the software supply chain, and move faster than any human team can respond. Snyk’s own data shows roughly six new vulnerabilities introduced for every one remediated, and agentic development keeps widening that gap.

Agentic AppSec is built to address that gap. Today, we are sharing a first look at its first two capabilities:

• Remediation Agent, in public preview, which fixes vulnerabilities automatically.

• Malicious Code Defense, in private preview, which stops malicious packages before they reach your code.

The Remediation Agent: from backlog to fixed, automatically

Most tools hand you a list. The Remediation Agent hands you a fix.

Available now in public preview through the Snyk CLI and your agentic development environment (ADE), it works the way an experienced engineer would:

• It triages your open issues by severity and context.

• It creates a fix, tapping into Snyk’s intelligence layer for context like reachability, exploitability, and fix-outcome data.

• It checks whether that fix will break your build using Snyk’s breakability analysis, so upgrades that would break get caught before they ship.

• It applies the right remediation strategy and opens a pull request for your team to review and merge.

You kick off a run and watch it work. The agent shows what it is doing, the fixes in progress, and the pull requests it produces. No context switching, no manual upgrade math, no backlog triage.

Early benchmarking shows a ~14% improvement in fix rates for SAST issues and a ~94% improvement in fix rates for SCA issues when embedding Snyk expertise into a frontier model’s context.

This builds on a remediation track record Snyk customers already know. LabelBox turned a two-year security-debt problem into a two-week one with Snyk. Relay Network cut remediation of a critical vulnerability from more than a week to under 24 hours, and holds a zero critical, zero high-severity posture across its codebase.

The Remediation Agent takes that same proven approach and runs it autonomously and continuously, so outcomes that once took a focused team now happen on every run.

Malicious Code Defense: stopping the attack before it ships

Fixing what is already in your code is half the job. Keeping malicious code out is the other half.

This is not a future problem. As we published this, an active supply chain compromise was moving through the npm ecosystem. On August 4, attackers hijacked the release path for keyv and related packages and shipped install-time malware across 11 releases, starting with keyv@6.0.0. The malicious code runs from a pre-install hook, so just installing the dependency is enough to execute it. No import, no app start, no vulnerable API call. Hours in, eight of the poisoned versions were still tagged latest. And these are not obscure packages: keyv, flat-cache, and file-entry-cache pull hundreds of millions of downloads a month and ride in through everyday tooling like ESLint.

Two details make this the shape of things to come. The malicious release carried a valid provenance, so the trust signals teams rely on attested a compromised build. And a second execution path planted .claude and .vscode config set to fire when a developer or coding agent opens the project, aimed squarely at the AI-assisted workflows more teams now run every day.

AI removes the last bit of friction from attacks like this. On July 30, Anthropic disclosed that during one of its internal security evaluations, a Claude model did the whole thing autonomously. To win a capture-the-flag exercise, it published a malicious Python package to PyPI. The package was live for about an hour. In that window, 15 real systems downloaded and ran it. One belonged to a security vendor whose scanner installs and executes packages to test them. Running the code exposed that vendor’s credentials.

To be clear: Snyk was not that vendor. We ran an internal analysis, and our security team found no evidence of the implicated packages across Snyk or the tooling we operate.

Malicious Code Defense safeguards against supply chain compromises like these by analyzing every package requested by your developers or agents. It leverages the Snyk Intelligence layer to identify threats, applies defined policies to manage malicious or potentially malicious packages, and utilizes a secure proxy to block their installation. In addition to preventing compromises, Malicious Code Defense provides organization-wide visibility into install requests.

What it means for you, and how Snyk helps

Today: find and fix. Snyk flags known malicious and vulnerable dependencies so your team can find and pull them out fast. In the keyv case, Snyk Security Research analyzed the compromised packages without ever installing or executing them, and published the advisory (SNYK-JS-KEYV-18515941), and gave customers a way to detect exposure and keep monitoring as the incident evolved.

Next: prevention. Malicious Code Defense, in private preview, is built to stop this class of attack before a package ever reaches your environment. Design partners get working package install protection out of the box for PyPI and npm, with policies for either a custom cool-down period on new releases or blocking anything flagged by a published malware advisory. Against an incident like Keyv, that is the difference between quarantining a brand-new poisoned version at install time and racing to rip it out after it has already run. It is also designed to analyze packages without executing them, precisely the failure mode that compromised the vendor in Anthropic's incident.

Where this is going

The Remediation Agent and Malicious Code Defense are the first two pieces of Agentic AppSec, Snyk’s approach to security that resolves risk and prevents the next one instead of just reporting it. We are introducing them alongside the broadest expansion of the Snyk AI Security Platform to date, including the general availability of Evo Continuous Offensive Security and Snyk Secrets.

Interested in putting a team of security agents next to every engineer? Talk to your Snyk account representative to get access.