Snyk Launches Agentic AppSec to Counter AI-Driven Vulnerability Surge

Snyk has announced the launch of Evo Agentic AppSec, a new application security platform that uses autonomous agents to identify, fix, and verify software vulnerabilities. The company states that traditional security workflows are failing to keep pace with AI-driven development, where coding agents generate code faster than teams can review it for security flaws.

According to Snyk’s first-hand research, current AI models introduce several times more vulnerabilities per line of code than human developers. Many of these flaws involve business logic, access control, and authentication, areas where traditional pattern-based scanners have limited visibility. This surge in AI-generated code is exacerbating an existing imbalance in security remediation efforts.

The Growing Security Imbalance

Snyk’s data from October 2026 reveals that roughly eight new vulnerabilities are introduced for every one that is remediated. Security teams are already managing a backlog of latent risk and are flooded with findings, many of which are noise. Attackers are simultaneously using AI to identify weaknesses and combine lower-severity issues into more serious exploits, accelerating the threat landscape.

The company notes that in-depth security reviews, which are necessary to catch business logic flaws, require significant time and context. Consequently, most teams run these reviews only once for a handful of critical applications, leaving the majority of their codebase exposed to undetected risks during continuous development cycles.

Supply Chain and Workflow Challenges

Software supply chain attacks are compounding these issues, with malicious packages now accounting for most open-source zero-day vulnerabilities. Snyk reports more than 20 high-profile attacks in 2026, with growth on track to exceed 600% year over year. These malicious packages can steal credentials during installation, often before a pull request or CI scan runs.

Coding agents can introduce these unsafe packages without assessing their safety, bypassing traditional controls. Snyk argues that pull request scanning alone is insufficient because it cannot address every risk, particularly when code is generated continuously and dependencies cause harm before a scan begins. Effective application security must now run inside the coding workflow, in CI, and through deeper periodic analysis.

Agent-Driven Remediation

Evo Agentic AppSec operates as a team of security agents that perform the work of an application security program, allowing human teams to focus on setting policy and owning decisions. The agents work across new code during development to prevent issues and block malicious package installations, while also addressing vulnerabilities in already shipped applications to reduce the backlog.

In Snyk’s VulnBump benchmark, which tests real dependency upgrades, the Evo Remediation Agent produced mergeable fixes 90% of the time. This compares to a 59.6% success rate for the same model without Snyk’s context. A mergeable fix resolves the vulnerability while leaving the project able to build, ensuring that security remediation does not break the development workflow.

What should you do?

Security teams should evaluate whether their current scanning tools can detect business logic and authentication flaws introduced by AI coding agents. Organizations should review their dependency management processes to ensure that automated agents cannot install malicious packages before CI scans run. Teams should also assess their remediation backlogs to determine if current workflows can handle the increased volume of AI-generated vulnerabilities.

What to do and how to stay safe: Snyk

• Audit your development pipeline to ensure that AI coding agents are subject to the same security controls as human-written code.
• Implement checks that block the installation of unverified or malicious open-source packages before they reach the CI environment.
• Establish clear policies for prioritizing and validating fixes for business logic and access control vulnerabilities, which are harder to detect automatically.
• Monitor your vulnerability introduction-to-remediation ratio to identify if AI-driven development is outpacing your team’s capacity to secure code.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why are traditional scanners failing against AI-generated code?

Traditional scanners have limited visibility into business logic, access control, and authentication flaws, which are common in AI-generated code and require deeper context to detect.

How does Snyk’s Evo Agentic AppSec differ from standard scanners?

It uses security agents to continuously find, fix, and verify vulnerabilities across the entire development lifecycle, including preventing malicious package installs and validating fixes with deterministic engines.

What is the current ratio of vulnerabilities introduced versus remediated?

According to Snyk’s October 2026 data, roughly eight new vulnerabilities are introduced for every one that is remediated.