AI agents and assistants for application security in the software development lifecycle: SAST/SCA findings, suggested or automated fixes, pull-request security review, and related AppSec workflows. Coding platforms that only reach this category through a security-scanner integration are tagged as such and are not presented as dedicated security products.
49 listings · Open in directory filters · Market map
Cite as: Agent Index by Heritage Services, Code security AI agents, dataset v0.1.27 (https://theagentindex.io/categories/code-security/)
AI agents and assistants for application security in the software development lifecycle: SAST/SCA findings, suggested or automated fixes, pull-request security review, and related AppSec workflows. Coding platforms that only reach this category through a security-scanner integration are tagged as such and are not presented as dedicated security products. 49 verified listings from Agent Index dataset v0.1.27.
49 verified listings in dataset v0.1.27 (2026-10-27).
4 of 49 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand: HCL AppScan RapidFix (India), Kalpita CodeGuard (India), Nullify autonomous product-security agents (find-to-fix with merge-ready PRs and AI Pentest Agent) (Australia), Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing) (Japan).
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
Criteria from the open dataset — not a ranking, score or paid placement. How we verify
Use-case comparisons: AI code security agents · Agentic pentesting AI agents · US public-sector and FedRAMP AI agents · Cloud security (CNAPP) AI agents
Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.
LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL), plus agentic autofix (generally available 15 Oct 2026), where an alert is assigned to Copilot, which investigates, validates a fix and opens a pull request. Part of GitHub Code Security / Advanced Security.
Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.
Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
Sonar LLM-generated fix suggestions for a documented subset of SonarQube issues, in Cloud Team/Enterprise and Server Enterprise/Data Center editions.
Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.
Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.
Semgrep’s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform.
GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow.
Veracode’s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows.
Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
Agent orchestration platform (not a dedicated AppSec scanner) that opens auto-fix PRs from Snyk vulnerability scans and Sentry production errors.
Cognition’s autonomous coding agent. Listed here only for documented Snyk MCP/CLI scanning and SonarQube/Snyk/Checkmarx IDE plugins — not as a dedicated security product.
Factory’s Droid coding agents. Listed here only because Factory’s own pages document Snyk Studio integration for scan/fix/verify inside Droid workflows.
GitHub Copilot’s coding agent. Listed here only for the official workflow that assigns Dependabot security alerts to Copilot (or other agents) to open a draft fix PR.
On-demand penetration testing run by a fleet of AI hacker agents, paired with Hadrian Atlas for continuous external exposure management.
Offensive security platform using AI agents for attack surface discovery, business-logic DAST and multi-agent pentesting (Cascade) of APIs and web apps.
Agentic pull-request review platform (formerly CodiumAI) that flags bugs, security issues and rule violations with organisational context. A general code reviewer, not a dedicated SAST scanner.
Agentic AppSec from Valladolid-based Xygeni: DevAI scans code in the IDE and generates validated fixes (including for AI-generated code), while CoreAI prioritises risk and orchestrates remediation PRs across the platform.
AI-native AppSec platform that finds business-logic and auth flaws, validates findings from existing SAST tools, runs PR security reviews and generates one-click patches refined in natural language.
Security 'harness' that triages SAST/SCA/DAST/secrets findings for exploitability, opens fix pull requests with the analysis attached, works inside coding agents, and builds design-stage threat models.
Italian offensive-security platform whose agentic AI hacker continuously maps APIs and applications, chains API interactions to find exploitable flaws, and validates findings for remediation.
On-demand, code-aware web-app pentesting by AI agents built by Intruder's CREST-certified testers, with audit-ready reports in hours and issue-level 'micro pentests' to triage scanner findings.
Pre-built AppSec agents that read Endor findings against your source, write SAST fixes or file exceptions, pick safe dependency upgrades and open PRs, and answer malware-exposure and CI/CD posture questions inside your coding agents.
Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
Agentic AI triage and auto-fix for SAST findings in HCL AppScan: an LLM pass reviews each finding's accuracy and severity, filters false positives, and a deterministic codemod framework writes fixes in repos and pull requests.
All Hands AI (OpenHands)
United States
Agent platform with security integrations, not a dedicated AppSec scanner: OpenHands' open-source Vulnerability Fixer runs Trivy scans or ingests Snyk, Veracode or Checkmarx reports, then has OpenHands agents write and test fixes and open GitHub PRs.
AI offensive security platform whose agents run black- or white-box autonomous pentests, chain vulnerabilities across code, APIs, cloud and infrastructure, reproduce every finding, and re-test on each deployment.
Amazon Web Services
United States
AWS frontier agent (formerly AWS Security Agent) that runs on-demand penetration tests of your applications with tailored multi-step attack scenarios, reproducible proof and ready-to-implement fixes, billed per task-hour.
Cycode's AppSec AI agents that assess the exploitability of findings, generate fixes, analyse change impact and query the risk graph inside the Cycode platform.
UK AI code-security agent platform with reachability-validated scanning, PR scanning, IDE/agent integrations and an agent that writes risk-tiered fix PRs.
Indian autonomous DevSecOps agent that scans each commit, generates a secure patch and opens a human-approved pull request.
Agent platform with security integrations: AWS's agentic IDE and autonomous agent, with Kiro Powers for Snyk, Aikido, SonarQube and Sonatype scanning.
UK AI agents that investigate every cloud and code vulnerability with code-to-cloud context, decide exploitability and deliver fixes.
Belgian autonomous AI pentest: many agents map the app, test attack paths and re-exploit each finding to confirm it, with a same-day audit-grade report.
An AI agent that runs as a GitHub Action, takes vulnerabilities found by Contrast's IAST (Assess) and SAST, writes code fixes using runtime context, runs your build and tests, and opens pull requests for developers to review.
StackHawk (StackHawk, Inc.)
United States
Security plugin for AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex, Antigravity) that runs dynamic tests against the running app during the coding session, has the agent triage and fix what it finds, then rescans to prove the fix before the pull request. Published at US$10 per user per month.
depthfirst (DepthFirst AI, Inc.)
United States
San Francisco application-security platform whose autonomous AI agents trace business logic and data flows to find exploitable code vulnerabilities, check dependency reachability and secrets, review pull requests with proposed fixes, and run agentic pentests against running applications, re-running each attack after a fix merges to confirm it is closed.
Nullify (Nullify Holdings Pty Ltd)
Australia
Australian 'autonomous system of agents' for product security that covers code, secrets, API pentesting and exploit validation. It proves findings with reproducible evidence, scores them against the customer's assets, writes merge-ready fix PRs routed to code owners, and runs remediation campaigns through Jira and Slack until merge, with the customer keeping final merge approval.
AISLE (Aisle s.r.o. / Aisle Inc.)
Czech Republic
Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.
CybeDefend (CybeDefend SAS)
France
French AI code security platform (SAST, SCA, IaC, container and secret scanning) whose Cybe AutoFix agent reads the code graph, rewrites vulnerable lines or picks the safest dependency upgrade, tests the change in isolation and opens a bot-signed, CI-gated pull request for a human to merge.
GMO Flatt Security (GMO Flatt Security株式会社)
Japan
Japanese security AI agent that continuously finds vulnerabilities with AI-SAST and AI-DAST (including logic, authentication and authorisation flaws), generates fix patches and opens pull requests with unit tests, and runs AI penetration tests that actually attempt intrusion to prove exploitability.
Sourcery (Sourcery.AI Limited)
United Kingdom
London AI code reviewer for GitHub and GitLab that reviews every pull request within minutes, flags security issues and suggests commit-ready fixes, fails the check on high-severity security findings so merging can be blocked, auto-approves low-risk PRs with no blocking findings, and scans whole repositories every night for vulnerable code, exposed secrets, misconfigured infrastructure and vulnerable dependencies.
Ares Cyber (Ares Cyber S.r.l.)
Italy
Rome security-testing platform that runs SAST, SCA, IaC/secrets, DAST, vulnerability assessment and penetration testing as one pipeline, in which AI agents autonomously chain vulnerabilities and safely run exploits to prove which findings are exploitable, available as SaaS, self-hosted or an air-gapped appliance.
Cytix (Cytix Ltd)
United Kingdom
Manchester software-change security platform that risk-scores every code change, automatically approves changes that fall within the customer's own policy and escalates the rest, then sends sandboxed AI pentest agents against high-risk changes and logs every decision and tool call as an audit-ready change record.
SQUR (SQUR UG (haftungsbeschränkt))
Germany
German autonomous pentesting product for web apps and APIs: given a target URL, scope and optional source code, its AI agents carry out real exploitation, a separate agent re-tests every finding against the live app to weed out false positives, and a compliance-ready report with proof-of-exploit and remediation steps arrives within 24 hours; continuous monthly runs mark findings fixed, regressed or new.
US agentic development platform whose Security Agent reviews a project's full codebase (threat model plus Semgrep/HoundDog static analysis), Level 3 AI pentest black-box tests the running Preview, and accepted findings can be sent to Agent for parallel remediation with a follow-up rescan — listed as an agent platform with security integrations, not a dedicated AppSec scanner.
Amnify (Amnify GmbH)
Germany
German AppSec product from Düsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.
