Legit Security launches agentic remediation for open-source dependency vulnerabilities

Summary

Legit Security has expanded its Agentic Remediation capability to automatically fix vulnerabilities found in open-source dependencies, not just first-party code. This new feature aims to bridge the gap between vulnerability detection and verified fixes, especially as AI-generated code increases reliance on third-party packages. The agent identifies the vulnerable dependency, finds the safest upgrade, applies the fix, verifies it, and opens a pull request, with an AI-assisted analysis layer for major version upgrades.

Full text

Press ReleaseLegit Security launches agentic remediation for open-source dependency vulnerabilities Tel Aviv, Israel, 30th September 2026, CyberNewswire byCyberNewswireSeptember 30, 20262 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Tel Aviv, Israel, September 30th, 2026, CyberNewswire Legit Security today announced an expansion of its Agentic Remediation capability to cover vulnerabilities found in open-source dependencies, not just first-party code – enabling development teams to move from vulnerability detection to a verified fix without manual triage. The expansion addresses a growing gap in application security: as AI-generated code accelerates software delivery, most modern codebases are made up largely of open-source dependencies, and every new package introduces potential exposure to known vulnerabilities. Traditional find-it, fix-it AppSec workflows, which rely on human teams working down a backlog, can’t keep pace with that volume – particularly when the vulnerable code isn’t in a company’s own codebase but several layers deep in a third-party package. Legit’s Agentic Remediation previously focused on fixing static analysis findings in code written by a company’s own engineers. With this release, the same agent now takes on vulnerabilities introduced through dependencies, extending verified remediation to the other major source of vulnerabilities in modern software. “The real challenge isn’t finding vulnerabilities anymore – it’s getting from finding to fix fast enough,” the company said, noting that AI-generated code has multiplied the volume of software shipping daily while attackers increasingly use AI to find and exploit those vulnerabilities faster than defenders can respond. How it works When pointed at a vulnerable dependency, the agent: Identifies the dependency – the vulnerable package, its current version, and whether it’s a direct or indirect (transitive) dependency. Finds the safest upgrade – the smallest version bump that resolves the issue, staying within the current major version where possible to avoid breaking changes. Applies the fix – updates the dependency configuration and regenerates the lockfile, including any other instances of the vulnerable version elsewhere in the dependency tree. Verifies the fix – re-scans the dependency before and after the change to confirm the vulnerability is resolved and no new issue was introduced. Opens a pull request – delivering a ready-to-review PR with the fix and vulnerability details attached. Every fix is re-scanned before a PR is opened, so developers receive a change that has already been verified rather than a suggested version to try. Handling major version upgrades When a fix requires crossing a major version boundary – where breaking API changes become a risk – the agent adds an AI-assisted analysis layer that evaluates how the specific repository uses the package and proposes the source code adaptations needed, validated against the real repository and package data. Legit draws a clear distinction in these cases: the dependency fix itself is verified through re-scanning, like any other remediation, while the code adaptation for a major version jump is AI-assessed rather than independently verified. The company said the PR flags this distinction explicitly, so developers know what’s been verified and what warrants closer review before merging. About Legit Security Legit positions the expansion as part of a broader effort to close the gap between detection and a safe, verified fix across both first-party code and open-source dependencies – the two primary sources of vulnerabilities in modern software – without relying on manual backlog triage. Contact Dave HowellLegit Security[email protected] Leave a Reply Cancel reply View Comments (0) Related Posts Read More Press Release MCPTotal Launches to Power Secure Enterprise MCP Workflows New York, USA, New York, 15th October 2025, CyberNewsWire byCyberNewswire Read More Press Release CredShields Contributes to OWASP’s 2026 Smart Contract Security Priorities SINGAPORE, Singapore, 17th February 2026, CyberNewswire byCyberNewswire Read More Press Release Blockchain Sophon and Aethir Partner to Bring Decentralized Compute to The ZK Community Sophon and Aethir have announced the beginning of a strategic collaboration between the two networks, connecting the 800,000… byCyberNewswire Read More Press Release Connex IT Partners with AccuKnox for Zero Trust CNAPP Security in Southeast Asia Menlo Park, India, 6th January 2026, CyberNewsWire byCyberNewswire

Entities