Running a fix loop: from finding to merged change

The five steps of a fix loop

1. Pick. Which findings go to the agent? Ideally the triaged, high-priority ones, with limits on severity, repository or finding type.
2. Write. The agent produces a code change.
3. Validate. Something checks that the change removed the issue and did not break the build.
4. Land. The change arrives somewhere a person can review it, usually a branch and a pull request.
5. Review and learn. A person accepts or rejects it, and the system may reuse accepted patterns.

How vendors describe the steps

• Legit Security. Remediation agents fix first-party SAST findings and dependency vulnerabilities, re-scan before and after, and open a pull request with the fix and vulnerability details. Major-version code adaptations are flagged as AI-assessed in the PR.
• GitHub. Agentic autofix is generally available for Code Quality findings since 9 September 2026. A developer can assign up to 25 findings to Copilot at once; Copilot fixes them on a branch, validates its own changes and opens a pull request. Since 25 September 2026 it stores fix patterns in Copilot Memory for customers who have it enabled. Agentic autofix for code scanning alerts is in public preview.
• Cycode. The AI Fix and Remediation Agent analyzes the root cause and proposes fixes that match the codebase's frameworks, coding patterns and naming conventions, as PR-ready changes.
• Aikido Security. AutoFix opens pull requests, and the free Developer plan includes 10 AI AutoFixes a month.
• Snyk. A remediation agent entered public preview through the Snyk CLI and agentic development environments on 4 August 2026.
• Endor Labs. AURI Agents include AI SAST Remediation, which writes the fix or files the exception, and SCA Remediation, which picks a non-breaking version, runs the build and opens the PR. Mutating actions sit behind approval gates.
• OX Security. AI-Powered Fixes deliver one-click fixes in CI/CD pipelines, IDEs and pull or merge requests, with diffs and commit previews.

What to check in a trial

• Does validation re-run the scanner that found the issue, the tests, or both?
• Does every fix arrive as a pull request with the normal required checks and reviewers?
• Can you cap how many fixes the agent opens per day or per repository?
• Which finding types are in scope: first-party code, dependencies, code quality?
• Is the feature generally available, or a preview with different terms?

A note on dependency fixes

A fix to a dependency finding often means a version change. Treat an agent's lockfile change like any dependency change: it needs SCA on the pull request and a human reviewer.

What the reviewer still owns

A validated fix can still be the wrong fix: it can change behavior, hide a symptom or fight the codebase's conventions. Keep a human reviewer on every agent pull request, and track how often fixes are accepted. Lesson 8 covers that metric.