--- title: AWS Continuum claims 89%, but only 37.8% of patches... description: AWS Continuum claims an 89.0% score on the CyberGym-E2E security benchmark, beating the prior public high of 65.9%. But the headline figure measures whether... canonical: https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Continuum claims 89%, but only 37.8% of patches truly fix | daily.dev og:description: AWS Continuum claims an 89.0% score on the CyberGym-E2E security benchmark, beating the prior public high of 65.9%. But the headline figure measures whether... og:url: https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu og:image: https://api.daily.dev/og/posts/O47tRMsnU.png og:image:alt: AWS Continuum claims 89%, but only 37.8% of patches truly fix og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Continuum claims 89%, but only 37.8% of patches truly fix **[Trends](https://daily.dev/sources/trends)** · 2 min read · 0 upvotes · 0 comments ## Summary AWS Continuum claims an 89.0% score on the CyberGym-E2E security benchmark, beating the prior public high of 65.9%. But the headline figure measures whether the agent stopped a crash, not whether it fixed the actual vulnerability. Patches that truly fixed the historical bug the benchmark checked for landed in just 37.8% of tasks, versus a prior best of 26.2%. With more time, the score climbs to 93.7%. Continuum is now generally available in US East (N. Virginia) and US West (Oregon), building a context graph of repos and AWS resources and shipping fixes as GitHub pull requests that start out requiring human approval. ## Content AWS wants you to hear "89% of bugs fixed." The fine print says something less flattering. Continuum, AWS's code-security agent, is now generally available in US East (N. Virginia) and US West (Oregon). Alongside the launch, AWS reported an 89.0% end-to-end score on CyberGym-E2E, up from the previous public high of 65.9%. The benchmark gives an agent 90 minutes to find and fix a memory-safety bug in a C or C++ project, with no bug description and no proof of concept. ## The catch The 89% measures whether crashes stopped (89.6% of tasks). It does not measure whether the actual vulnerability was fixed. On that stricter test, which checks the specific historical bug, Continuum's patches landed in 37.8% of tasks. The prior best was 26.2%. That's still a real jump, but it's a different headline. Finding and reproducing bugs worked in 92.5% of tasks. AWS ran the tests itself, and with more time the score rises to 93.7%. ## What it actually does Continuum builds a context graph from your repositories and AWS environment: resource topology, identity relationships, network reachability. It uses that to judge whether a finding is reachable and exploitable. For reproducible bugs, it runs the exploit in an isolated sandbox and attaches proof-of-concept code. Fixes arrive as pull requests with blast-radius assessments, and a human approves before merge. In AWS's demo, a cart-service fix touched four files, adding 50 lines and removing 24. It starts in Learn mode, where you approve every proposed fix. Enforce mode lets it act autonomously within guardrails you set. It works alongside GuardDuty and Security Hub. ## The timing argument AWS pitched the launch with honeypot telemetry: a PHP2Shell exploit attempt on October 17, four days before CVE-2026-109618 and CVE-2026-109619 were disclosed. A companion essay makes the broader case. Attackers exploit vulnerabilities in about 10 hours, while enterprises take 32 to 43 days to patch. Models find chained bugs with 95% precision in CyberGym tests, yet refuse remediation prompts over 98% of the time because guardrails flag 76 to 99% of vulnerability code as false positives. When patches do ship, 40% break production code. That last number is the one I'd stare at. If four in ten patches break prod, a 37.8% true-fix rate with mandatory human review looks less like a weakness and more like the honest design. ## Questions this post answers ### What score did AWS Continuum get on the CyberGym-E2E benchmark? AWS Continuum scored 89.0% on CyberGym-E2E, beating the prior public high of 65.9%. That figure measures how often it stopped the crash, not whether it fixed the underlying vulnerability. When AWS re-ran the tests with more time, the score rose to 93.7%. The agent found and reproduced bugs in 92.5% of tasks. _Teams comparing AI security agents can track benchmark claims like this one on daily.dev._ ### How often do AI-generated security patches actually fix the real vulnerability instead of just stopping the crash? AWS Continuum's patches fixed the specific historical vulnerability checked by the CyberGym-E2E benchmark in only 37.8% of tasks, compared to a prior best of 26.2%. The 89% headline figure instead reflects how often the agent stopped the crash, a much lower bar than a true fix. _Engineers judging AI patch quality can follow benchmark nuances like this on daily.dev._ ### In which AWS regions is Continuum for code vulnerabilities generally available? Continuum for code vulnerabilities is generally available in US East (N. Virginia) and US West (Oregon). It builds a context graph from a customer's repos and AWS resources, including topology, identity relationships, and network reachability, and ships fixes as GitHub pull requests that initially require human approval in Learn mode. _Teams planning to pilot AWS Continuum can keep up with its rollout details on daily.dev._ ## Similar posts on daily.dev - [AWS Continuum offers devs help with securing code](https://daily.dev/posts/aws-continuum-offers-devs-help-with-securing-code-st5ogbomn) · InfoWorld · 0 upvotes · 0 comments - [Introducing AWS Continuum for security at machine speed](https://daily.dev/posts/introducing-aws-continuum-for-security-at-machine-speed-opmxtllii) · AWS · 0 upvotes · 0 comments - [AWS Continuum to Enable Agentic Code Security for Enterprises](https://daily.dev/posts/aws-continuum-to-enable-agentic-code-security-for-enterprises-rp1jg1hhu) · InfoQ · 0 upvotes · 0 comments - [When the patch tsunami meets the maintenance window](https://daily.dev/posts/when-the-patch-tsunami-meets-the-maintenance-window-lin3vzsv3) · CSO Online · 0 upvotes · 0 comments - [Security patches need patches now that attackers have AI](https://daily.dev/posts/security-patches-need-patches-now-that-attackers-have-ai-jxjf652el) · The Register · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Continuum claims 89%, but only 37.8% of patches truly fix","url":"https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu"},"datePublished":"2026-10-24T14:40:07.154Z","dateModified":"2026-10-26T15:45:46.925Z","description":"AWS Continuum claims an 89.0% score on the CyberGym-E2E security benchmark, beating the prior public high of 65.9%. But the headline figure measures whether...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b84744d963f02290bac0f24aa9392552?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b84744d963f02290bac0f24aa9392552?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,ai-agents","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"AWS Continuum claims 89%, but only 37.8% of patches truly fix"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-continuum-claims-89-but-only-37-8-of-patches-truly-fix-o47trmsnu#faq","mainEntity":[{"@type":"Question","name":"What score did AWS Continuum get on the CyberGym-E2E benchmark?","acceptedAnswer":{"@type":"Answer","text":"AWS Continuum scored 89.0% on CyberGym-E2E, beating the prior public high of 65.9%. That figure measures how often it stopped the crash, not whether it fixed the underlying vulnerability. When AWS re-ran the tests with more time, the score rose to 93.7%. The agent found and reproduced bugs in 92.5% of tasks. Teams comparing AI security agents can track benchmark claims like this one on daily.dev."}},{"@type":"Question","name":"How often do AI-generated security patches actually fix the real vulnerability instead of just stopping the crash?","acceptedAnswer":{"@type":"Answer","text":"AWS Continuum's patches fixed the specific historical vulnerability checked by the CyberGym-E2E benchmark in only 37.8% of tasks, compared to a prior best of 26.2%. The 89% headline figure instead reflects how often the agent stopped the crash, a much lower bar than a true fix. Engineers judging AI patch quality can follow benchmark nuances like this on daily.dev."}},{"@type":"Question","name":"In which AWS regions is Continuum for code vulnerabilities generally available?","acceptedAnswer":{"@type":"Answer","text":"Continuum for code vulnerabilities is generally available in US East (N. Virginia) and US West (Oregon). It builds a context graph from a customer's repos and AWS resources, including topology, identity relationships, and network reachability, and ships fixes as GitHub pull requests that initially require human approval in Learn mode. Teams planning to pilot AWS Continuum can keep up with its rollout details on daily.dev."}}]} ```