AGNTCon + MCPCon Europe 2026

AI is accelerating vulnerability discovery, finding more security issues than any team can fix by hand. The obvious next step is letting AI fix them too, but pushing automated changes into production is difficult, and the trust bar is super high.

Over the past year, we built and shipped two autonomous remediation agents raising PRs against hundreds of production repositories: one for SAST findings in first-party code, and one for SCA findings in third-party libraries. While developers can already fix vulnerabilities by going back and forth with a general-purpose AI assistant, our goal is to make that loop faster and more trustworthy.

That trust came from unglamorous engineering: teaching our agents how to build and test an application, trace data flows to reject risky fixes, and resolve breaking changes when modernizing legacy code. Along the way, we’ll share common patterns we’ve seen across rejected PRs, and what we had to iterate on to get hundreds of them merged.

We are open sourcing both agents for the community. The volume of CVEs keeps growing, automated remediation will become a must, and existing solutions don't yet solve this problem at the level we need.