Skip to content
AI Agents Tested for Safe Dependency Upgrades in Vulnerable Projects

AI Agents Tested for Safe Dependency Upgrades in Vulnerable Projects

First seen 15 Oct 2026, 15:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 16:37 UTC
  • •Snyk recorded 459 million vulnerabilities across ~300,000 organizations in 2026.
  • •Only 10% of known vulnerabilities were resolved, despite 94% having fixes.
  • •Snyk's Evo Remediation Agent outperformed Claude Code in successfully removing vulnerabilities.

Snyk's VulnBump research evaluates AI agents' ability to fix vulnerable dependencies without breaking builds. Over six months, Snyk identified 459 million vulnerabilities across ~300,000 organizations, with 94% having known fixes but only 10% resolved. The study tested 307 real upgrades, revealing that Snyk's Evo Remediation Agent achieved a 90.2% success rate in removing vulnerabilities while maintaining build integrity. In contrast, Anthropic's Claude Code had a 77.5% success rate with Snyk's guidance and only 59.6% unaided. The research highlights the challenges of upgrading dependencies, as many vulnerable packages are transitively imported and may introduce breaking changes. VulnBump is the first benchmark focusing on security-driven upgrades, emphasizing the need for effective AI tools in dependency management.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
VulnBump research published
Snyk released findings on AI agents' effectiveness in fixing vulnerable dependencies, testing 307 upgrades.
Snyk
2026-10-15
Benchmark results shared
Results showed Evo Remediation Agent had a 90.2% success rate in upgrades, while Claude Code's success varied significantly based on guidance.
github.com

More articles in this cluster (2)

Extracted Entities (13)

1 / 2

Common questions

What vulnerabilities were addressed in the study?
The study focused on vulnerabilities found in real projects, with 459 million vulnerabilities identified across various organizations.
How effective were the AI agents in fixing vulnerabilities?
Snyk's Evo Remediation Agent achieved a 90.2% success rate, while Claude Code's effectiveness varied significantly based on whether it used Snyk's guidance.
What challenges do developers face when upgrading dependencies?
Many vulnerable packages are transitively imported, and a significant number of fixes require major version bumps that can introduce breaking changes.