Legit Security has announced an expansion of its Agentic Remediation capability to automatically address vulnerabilities found in open-source dependencies. This update allows development teams to move directly from vulnerability detection to a verified fix without requiring manual triage, a process previously limited to first-party code.
The expansion targets a growing challenge in application security, where modern codebases are increasingly composed of open-source dependencies. Each new package introduces potential exposure to known vulnerabilities, and the acceleration of software delivery through AI-generated code has amplified this issue. Traditional application security workflows, which rely on human teams to address backlogs, struggle to keep pace with the volume of vulnerabilities, especially when they are embedded deep within third-party packages rather than a company's own codebase.
Legit Security's Agentic Remediation previously focused on resolving static analysis findings in code written by a company’s own engineers. With this release, the same agent now handles vulnerabilities introduced through dependencies, extending verified remediation to another major source of vulnerabilities in contemporary software development. The company stated that the primary challenge has shifted from merely finding vulnerabilities to implementing fixes rapidly enough, particularly as attackers increasingly leverage AI to exploit vulnerabilities faster than defenders can respond.
When pointed at a vulnerable dependency, the agent performs several steps. It first identifies the vulnerable package, its current version, and whether it is a direct or indirect (transitive) dependency. Next, it determines the safest upgrade, aiming for the smallest version bump that resolves the issue and staying within the current major version when possible to minimize breaking changes.
The agent then applies the fix by updating the dependency configuration and regenerating the lockfile, ensuring all instances of the vulnerable version across the dependency tree are addressed. A critical step involves verifying the fix through a re-scan of the dependency both before and after the change to confirm the vulnerability is resolved and no new issues have been introduced. Finally, it opens a pull request (PR) that includes the verified fix and vulnerability details. Developers receive a change that has already been verified, rather than a suggested version to test.
For situations where a fix necessitates crossing a major version boundary, which carries a higher risk of breaking API changes, the agent incorporates an AI-assisted analysis layer. This layer evaluates how the specific repository utilizes the package and proposes necessary source code adaptations. These adaptations are validated against the actual repository and package data.
While the dependency fix itself is verified through re-scanning, similar to other remediations, the code adaptation required for a major version jump is AI-assessed rather than independently verified. The company noted that the PR explicitly flags this distinction, informing developers which aspects have been verified and which warrant closer review before merging.
