Reading vendor claims about AppSec agents: preview, GA and what validated means

1. Release status

Agent features ship in stages. In this category in 2026 you will see private beta, public beta, public preview and general availability, sometimes for parts of the same feature. Examples from vendor pages and changelogs:

• Snyk's remediation agent entered public preview through the CLI on 4 August 2026, the same day Snyk Secrets became generally available.
• GitHub's agentic autofix became generally available for Code Quality findings on 9 September 2026, while agentic autofix for code scanning alerts is in public preview.
• Semgrep's nine agentic workflows are in public beta since 28 July 2026, and its Malware Firewall is in private beta.
• GitHub's AI Scan for pull requests is in public preview.

A preview can change or disappear, and its support terms often differ. Our scoring credits generally available features more than previews.

2. Scope

"Fixes vulnerabilities" can mean first-party code, dependencies or code quality. GitHub's general availability, for example, covers Code Quality findings. Ask which finding types are in scope today.

3. Plan

A feature on the product page may sit in a higher plan. Snyk's plans page states that Evo capabilities, including coding agent security, require an Enterprise Platform Subscription. Ask which plan includes the agent feature you are evaluating.

4. Named agents

"Works with AI coding assistants" is not the same as naming Claude Code, Cursor or GitHub Copilot. Our census records only agents a vendor names. When an agent is not named, ask for the page that names it.

5. What the page does not say

Read for gaps: where a fix lands, whether it is validated, what happens when a developer disables the control, what it costs. "Not stated" is not "not available", but it is a question for the call.

Dates matter

Launch dates tell you how mature a feature is. Snyk announced Evo Agentic Development Security on 23 June 2026 with general availability set for 29 June 2026. A feature launched last month has less field history than one launched last year, whatever the page says.

Turn gaps into questions

For each shortlisted vendor, write one line per gap: "Page says X; does not say Y; please send the page that covers Y." Vendors that answer with a public page make the comparison easier, and the answer can be checked later.

Separate the vendor's numbers from yours

When a page quotes a percentage or a time saved, note whose workload it came from and when. Keep those figures in a separate column from anything you measure in a trial. A vendor figure can tell you what is possible on the vendor's workload; only your own trial tells you what happens on yours.