Legit Security Agent Auto-Fixes Vulnerable Dependencies
Legit Security's agentic remediation now fixes vulnerable open-source dependencies, re-scans before and after, and opens a pull request for review.
Finding a vulnerable open-source package is the easy part; getting the fix merged is where teams stall. Legit Security says its new agentic remediation closes that gap for open-source dependencies, announced on September 30, 2026.
- The agent handles both direct and transitive dependencies.
- It picks the safest upgrade, meaning the smallest version change that resolves the issue.
- It updates configuration files, regenerates lockfiles and re-scans before and after the change.
- It opens a pull request with the vulnerability details for a human to review.
How does agentic dependency remediation work?
According to Legit Security and Help Net Security, the agent first identifies the vulnerable package, its version and whether it is a direct or transitive dependency. It then applies the upgrade, adjusts the project files and runs a scan to confirm the vulnerability is gone and nothing new appeared. The result lands as a pull request, so reviewers keep the final say.
What happens with breaking major-version upgrades?
For jumps that change an API, the agent proposes source-code adaptations validated against real repository and package data. The pull request labels these changes as AI-assessed rather than independently verified. Marking uncertainty that plainly is a good habit for any security automation, and it keeps reviewers focused where they are needed.
Why does this matter for developers?
A company quote sums up the idea: the real challenge is no longer finding vulnerabilities but getting from finding to fix fast enough. Automating the routine upgrades frees engineers for the harder work. Related reading includes how GitHub AI taskflows found Android app vulnerabilities and how Chainloop signs CI build artifacts. More defensive tools are in our AI security section.
The details here come from Legit Security and its coverage, so we attribute the capability claims to the company.
Sources: Help Net Security — October 1, 2026; Legit Security press release via GlobeNewswire — September 30, 2026.
More Ai Security Stories
Thales Sentinel Envelope Plus: Shielding Code From AI Agents
Thales Sentinel Envelope Plus hardens compiled apps against AI reverse engineering. In tests, an AI agent found 0 of 10 bugs after using 970x more tokens.
Android 17 Advanced Protection: 6 New Anti-Spyware Defenses
Android 17 Advanced Protection adds 6 new defenses, including Intrusion Logging with 12 months of encrypted logs and USB lockdown. Here's how each works.
GitHub AI Taskflows Found 24 Android App Vulnerabilities
GitHub Security Lab used open-source AI taskflows to uncover 24 Android app vulnerabilities, with every finding reviewed by a human before disclosure.