OpenHands Vulnerability Fixer (agent platform with security integrations)

What it does

OpenHands is an open-source, model-agnostic coding-agent platform from All Hands AI (Cambridge, Massachusetts). It's listed here as an agent platform with security integrations, not a dedicated security product. On Mar 3, 2026 OpenHands released Vulnerability Fixer, an open-source app with a hosted version on OpenHands Hub. It runs Trivy security scans on a GitHub repository or accepts uploaded reports from other scanners such as Snyk, Veracode and Checkmarx, converts findings to a common schema and prioritises them. For each selected vulnerability, a separate OpenHands agent generates and tests a fix and opens a GitHub pull request, with progress and logs streamed in a web UI. It works against OpenHands Cloud or a local agent server, and OpenHands also presents it as a reference implementation for building apps on the OpenHands Cloud API. OpenHands itself is free to run locally and on the individual SaaS tier (bring your own key or at-cost models); Enterprise is custom-priced.

Frameworks (vendor-stated)

No framework tags yet.

Pricing (as published)

Open-source local OpenHands: free. Individual SaaS: free (bring your own LLM key or use OpenHands models at cost). Enterprise (SaaS or self-hosted in your VPC): custom pricing (openhands.dev/pricing).

Tasks

agent platform with security integrationsremediationscavulnerability management

Sources

1. openhands.dev/blog/20260303-vulnerability-fixer (primary)
2. docs.openhands.dev/openhands/usage/use-cases/vulnerability-remediation
3. openhands.dev/pricing
4. openhands.dev/privacy

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email [email protected]. See our methodology.

Compare OpenHands Vulnerability Fixer (agent platform with security integrations) with

• 
  Aikido AI AutoFix vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Amazon Q Developer security scanning vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Black Duck Signal (agentic AI AppSec) vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Checkmarx One Assist vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Claude Code security review vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Codacy AI Reviewer vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Contrast AI SmartFix (agentic vulnerability remediation) vs OpenHands Vulnerability Fixer (agent platform with security integrations)
• 
  Cursor Bugbot vs OpenHands Vulnerability Fixer (agent platform with security integrations)

Alternatives

• 
  Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) — Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.
• 
  Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) — German AppSec product from Düsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.
• 
  Black Duck Signal (agentic AI AppSec) — Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
• 
  Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.

See all OpenHands Vulnerability Fixer alternatives →

FAQ (from this dataset)

What does OpenHands Vulnerability Fixer do?

Agent platform with security integrations, not a dedicated AppSec scanner: OpenHands' open-source Vulnerability Fixer runs Trivy scans or ingests Snyk, Veracode or Checkmarx reports, then has OpenHands agents write and test fixes and open GitHub PRs.

How much does OpenHands Vulnerability Fixer cost?

Open-source local OpenHands: free. Individual SaaS: free (bring your own LLM key or use OpenHands models at cost). Enterprise (SaaS or self-hosted in your VPC): custom pricing (openhands.dev/pricing).

Where is All Hands AI (OpenHands) headquartered?

United States

What are alternatives to OpenHands Vulnerability Fixer?

See the OpenHands Vulnerability Fixer alternatives page for category-sharing listings in relevance order, not a ranking. OpenHands Vulnerability Fixer alternatives.

Stay updated