--- title: Remediation Agents and Agentic AppSec Explained | daily.dev description: Snyk's Remediation Agent, now in public preview, aims to close the gap between finding and fixing vulnerabilities, addressing a reported ratio of six new... canonical: https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Remediation Agents and Agentic AppSec Explained | daily.dev og:description: Snyk's Remediation Agent, now in public preview, aims to close the gap between finding and fixing vulnerabilities, addressing a reported ratio of six new... og:url: https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex og:image: https://api.daily.dev/og/posts/Nx3e6G4eX.png og:image:alt: Remediation Agents and Agentic AppSec Explained og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remediation Agents and Agentic AppSec Explained **[Snyk](https://daily.dev/sources/snyk)** · 7 min read · 1 upvotes · 0 comments ## Summary Snyk's Remediation Agent, now in public preview, aims to close the gap between finding and fixing vulnerabilities, addressing a reported ratio of six new security issues for every one remediated. Rather than a naive LLM-driven fix (which required heavy developer review and rejected most changes), the agent acts as an orchestration layer feeding a model ten years of Snyk's application security knowledge: breakability assessments for upgrades, package health and reachability scores, SAST fix generation, and ecosystem playbooks written by security engineers. Internal results cited are a 94% improvement in mergeable SCA fixes and 13% improvement in mergeable SAST fixes. A live demo showed both an IDE path (via a /snyk-fix skill and Snyk Studio MCP server in Cursor, Windsurf, Antigravity, or VS Code) and a CLI path (snyk fix --agentic --experimental --sca) fixing vulnerabilities in OWASP Juice Shop, including a multer and Glob upgrade. Every fix still ends at a pull request requiring developer sign-off, though an autonomous variant that generates finished PRs is in active development. The Remediation Agent is free for current Snyk customers during the feedback-driven preview, and free for open source maintainers via Snyk's Secure Developer Program. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Snyk's Remediation Agent and how does it fix vulnerabilities automatically? It is a harness or orchestration layer, now in public preview, that sits between a developer's chosen LLM and Snyk's intelligence layer covering every issue and CVE Snyk tracks. It supplies breakability assessments, package health and reachability scores, SAST fix generation via Agent Fix, and ecosystem playbooks, then re-scans and runs tests before opening a pull request for developer review. _Developers weighing AI-assisted vulnerability fixes can follow tooling shifts like this one on daily.dev._ ### How much better are AI-generated security fixes when the LLM is given Snyk's own remediation intelligence instead of running unassisted? Feeding an LLM ecosystem-specific upgrade knowledge, breakability scoring, and security playbooks instead of letting it work unaided produced a 94% improvement in mergeable SCA fixes and a 13% improvement in mergeable SAST fixes, with most SAST fixes merging as-is, all at lower token cost than the naive approach of just pointing an LLM at the backlog. _Teams comparing AI remediation approaches can track these efficiency benchmarks on daily.dev._ ### How do I run Snyk's agentic dependency fix command from the CLI? Use `snyk fix --agentic --experimental --sca`, which lists every package it can upgrade alongside current and recommended target versions plus a breakability score. Developers can fix everything, fix only low-breakability items, select specific findings, or talk to the agent to ask why a given upgrade is rated risky, such as a major-version jump changing an API from callback-based to promise-based. _Developers adopting agentic CLI workflows for dependency fixes can find setup details like this via daily.dev._ ## Similar posts on daily.dev - [The full Snyk AI Security Platform, free for open source maintainers](https://daily.dev/posts/the-full-snyk-ai-security-platform-free-for-open-source-maintainers-im8kpokj0) · Snyk · 0 upvotes · 0 comments - [Agentic Remediation Just Got Bigger: Now Fixing Vulnerabilities in Your Dependencies, Not Just Your Code](https://daily.dev/posts/agentic-remediation-just-got-bigger-now-fixing-vulnerabilities-in-your-dependencies-not-just-your--zwjgkeqvv) · Security Boulevard · 0 upvotes · 0 comments - [Snyk and Atlassian Unveil Intelligent Remediation for Jira](https://daily.dev/posts/snyk-and-atlassian-unveil-intelligent-remediation-for-jira-ekdotppha) · Snyk · 1 upvotes · 0 comments - [Automate remediation with ready-to-merge AI code fixes](https://daily.dev/posts/automate-remediation-with-ready-to-merge-ai-code-fixes-esyrpqr7h) · GitLab · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Remediation Agents and Agentic AppSec Explained","url":"https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex"},"datePublished":"2026-08-20T13:12:08.079Z","dateModified":"2026-09-14T09:09:53.377Z","description":"Snyk's Remediation Agent, now in public preview, aims to close the gap between finding and fixing vulnerabilities, addressing a reported ratio of six new...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a8911f51add5045fdb5c42d78463253?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a8911f51add5045fdb5c42d78463253?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snyk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snyk","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8fb2a7b471c04bac9af29fbeb3ed1cf6","url":"https://daily.dev/sources/snyk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,appsec","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snyk","item":"https://daily.dev/sources/snyk"},{"@type":"ListItem","position":3,"name":"Remediation Agents and Agentic AppSec Explained"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/remediation-agents-and-agentic-appsec-explained-nx3e6g4ex#faq","mainEntity":[{"@type":"Question","name":"What is Snyk's Remediation Agent and how does it fix vulnerabilities automatically?","acceptedAnswer":{"@type":"Answer","text":"It is a harness or orchestration layer, now in public preview, that sits between a developer's chosen LLM and Snyk's intelligence layer covering every issue and CVE Snyk tracks. It supplies breakability assessments, package health and reachability scores, SAST fix generation via Agent Fix, and ecosystem playbooks, then re-scans and runs tests before opening a pull request for developer review. Developers weighing AI-assisted vulnerability fixes can follow tooling shifts like this one on daily.dev."}},{"@type":"Question","name":"How much better are AI-generated security fixes when the LLM is given Snyk's own remediation intelligence instead of running unassisted?","acceptedAnswer":{"@type":"Answer","text":"Feeding an LLM ecosystem-specific upgrade knowledge, breakability scoring, and security playbooks instead of letting it work unaided produced a 94% improvement in mergeable SCA fixes and a 13% improvement in mergeable SAST fixes, with most SAST fixes merging as-is, all at lower token cost than the naive approach of just pointing an LLM at the backlog. Teams comparing AI remediation approaches can track these efficiency benchmarks on daily.dev."}},{"@type":"Question","name":"How do I run Snyk's agentic dependency fix command from the CLI?","acceptedAnswer":{"@type":"Answer","text":"Use `snyk fix --agentic --experimental --sca`, which lists every package it can upgrade alongside current and recommended target versions plus a breakability score. Developers can fix everything, fix only low-breakability items, select specific findings, or talk to the agent to ask why a given upgrade is rated risky, such as a major-version jump changing an API from callback-based to promise-based. Developers adopting agentic CLI workflows for dependency fixes can find setup details like this via daily.dev."}}]} ```