AI code security agents

Print / Save PDF

Verified listings whose primary job is code/application security (SAST/SCA findings, AI suggested fixes, PR security review, or AI DAST/pentest of applications). This update adds Amnify security agents (agent-driven audit, pentest, PR review and autofix PRs). AISLE announced a letter of intent to be acquired by Cohere (15 Oct 2026; not closed). Coding platforms that only integrate with scanners (Tembo, Devin, Factory Droids, GitHub Copilot coding agent, OpenHands Vulnerability Fixer, Kiro) are listed in the Code security category with an “agent platform with security integrations” tag and are omitted from this table so they are not presented as dedicated AppSec tools. Fields come from the open dataset. This is not a ranking or score.

Columns

GitHub Copilot Autofix Claude Code security review Cursor Bugbot Snyk Aikido AI AutoFix SonarQube AI CodeFix and Remediation Agent Codacy AI Reviewer Checkmarx One Assist Semgrep Multimodal GitLab Duo Vulnerability Resolution Veracode Fix Amazon Q Developer security scanning Escape (AI pentesting and DAST) Qodo multi-agent code review Xygeni DevAI and CoreAI (agentic AppSec) ZeroPath (AI-native SAST and autofix) Pixee (automated triage and fix) Endor Labs security agents (agentic triage and remediation) Black Duck Signal (agentic AI AppSec) HCL AppScan RapidFix Cycode AI Teammates (Exploitability, Remediation and Change Impact agents) Phoenix Purple (Phoenix Security) Kalpita CodeGuard Contrast AI SmartFix (agentic vulnerability remediation) StackHawk Wingman (find-fix-verify security for AI coding agents) depthfirst autonomous security agents (code, supply chain, secrets and agentic pentesting) Nullify autonomous product-security agents (find-to-fix with merge-ready PRs and AI Pentest Agent) AISLE (autonomous vulnerability discovery, triage and verified-fix agents) CybeDefend Cybe AutoFix (AI code security agent that opens tested fix pull requests) Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing) Sourcery AI code review and security scanning (PR review bot with merge-blocking security checks, auto-approval of low-risk PRs and nightly codebase scans) Cytix agentic pentesting and automatic change approvals (change-driven software security) Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests)

Hide columns to focus the table. The full comparison stays in the HTML.

Field	GitHub Copilot Autofix	Claude Code security review	Cursor Bugbot	Snyk	Aikido AI AutoFix	SonarQube AI CodeFix and Remediation Agent	Codacy AI Reviewer	Checkmarx One Assist	Semgrep Multimodal	GitLab Duo Vulnerability Resolution	Veracode Fix	Amazon Q Developer security scanning	Escape (AI pentesting and DAST)	Qodo multi-agent code review	Xygeni DevAI and CoreAI (agentic AppSec)	ZeroPath (AI-native SAST and autofix)	Pixee (automated triage and fix)	Endor Labs security agents (agentic triage and remediation)	Black Duck Signal (agentic AI AppSec)	HCL AppScan RapidFix	Cycode AI Teammates (Exploitability, Remediation and Change Impact agents)	Phoenix Purple (Phoenix Security)	Kalpita CodeGuard	Contrast AI SmartFix (agentic vulnerability remediation)	StackHawk Wingman (find-fix-verify security for AI coding agents)	depthfirst autonomous security agents (code, supply chain, secrets and agentic pentesting)	Nullify autonomous product-security agents (find-to-fix with merge-ready PRs and AI Pentest Agent)	AISLE (autonomous vulnerability discovery, triage and verified-fix agents)	CybeDefend Cybe AutoFix (AI code security agent that opens tested fix pull requests)	Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)	Sourcery AI code review and security scanning (PR review bot with merge-blocking security checks, auto-approval of low-risk PRs and nightly codebase scans)	Cytix agentic pentesting and automatic change approvals (change-driven software security)	Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests)
Vendor	GitHub	Anthropic	Anysphere	Snyk	Aikido Security	SonarSource	Codacy	Checkmarx	Semgrep	GitLab	Veracode	Amazon Web Services	Escape	Qodo (Codium Ltd.)	Xygeni Security	ZeroPath	Pixee	Endor Labs	Black Duck	HCLSoftware (HCLTech)	Cycode	Phoenix Security	Kalpita Technologies	Contrast Security	StackHawk (StackHawk, Inc.)	depthfirst (DepthFirst AI, Inc.)	Nullify (Nullify Holdings Pty Ltd)	AISLE (Aisle s.r.o. / Aisle Inc.)	CybeDefend (CybeDefend SAS)	GMO Flatt Security (GMO Flatt Security株式会社)	Sourcery (Sourcery.AI Limited)	Cytix (Cytix Ltd)	Amnify (Amnify GmbH)
HQ	United States · North America	United States · North America	United States · North America	United States · North America	Belgium · Europe	Switzerland · Europe	Portugal · Europe	Israel · Middle East	United States · North America	United States · North America	United States · North America	United States · North America	France · Europe	Israel · Middle East	Spain · Europe	United States · North America	United States · North America	United States · North America	United States · North America	India · India	Israel · Middle East	United Kingdom · Europe	India · India	United States · North America	United States · North America	United States · North America	Australia · Australia and New Zealand	Czech Republic · Europe	France · Europe	Japan · Asia Pacific	United Kingdom · Europe	United Kingdom · Europe	Germany · Europe
Primary category	Code security	Code security	Code security	Security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security	Code security
Also listed in	Code security, Security	Code security, Security	Code security, Security	Security, Code security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security	Code security, Security
Summary	LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL), plus agentic autofix (generally available 15 Oct 2026), where an alert is assigned to Copilot, which investigates, validates a fix and opens a pull request. Part of GitHub Code Security / Advanced Security.	Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.	Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.	Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.	Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.	Sonar LLM-generated fix suggestions for a documented subset of SonarQube issues, in Cloud Team/Enterprise and Server Enterprise/Data Center editions.	Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.	Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.	Semgrep’s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform.	GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow.	Veracode’s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows.	Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.	Offensive security platform using AI agents for attack surface discovery, business-logic DAST and multi-agent pentesting (Cascade) of APIs and web apps.	Agentic pull-request review platform (formerly CodiumAI) that flags bugs, security issues and rule violations with organisational context. A general code reviewer, not a dedicated SAST scanner.	Agentic AppSec from Valladolid-based Xygeni: DevAI scans code in the IDE and generates validated fixes (including for AI-generated code), while CoreAI prioritises risk and orchestrates remediation PRs across the platform.	AI-native AppSec platform that finds business-logic and auth flaws, validates findings from existing SAST tools, runs PR security reviews and generates one-click patches refined in natural language.	Security 'harness' that triages SAST/SCA/DAST/secrets findings for exploitability, opens fix pull requests with the analysis attached, works inside coding agents, and builds design-stage threat models.	Pre-built AppSec agents that read Endor findings against your source, write SAST fixes or file exceptions, pick safe dependency upgrades and open PRs, and answer malware-exposure and CI/CD posture questions inside your coding agents.	Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.	Agentic AI triage and auto-fix for SAST findings in HCL AppScan: an LLM pass reviews each finding's accuracy and severity, filters false positives, and a deterministic codemod framework writes fixes in repos and pull requests.	Cycode's AppSec AI agents that assess the exploitability of findings, generate fixes, analyse change impact and query the risk graph inside the Cycode platform.	UK AI code-security agent platform with reachability-validated scanning, PR scanning, IDE/agent integrations and an agent that writes risk-tiered fix PRs.	Indian autonomous DevSecOps agent that scans each commit, generates a secure patch and opens a human-approved pull request.	An AI agent that runs as a GitHub Action, takes vulnerabilities found by Contrast's IAST (Assess) and SAST, writes code fixes using runtime context, runs your build and tests, and opens pull requests for developers to review.	Security plugin for AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex, Antigravity) that runs dynamic tests against the running app during the coding session, has the agent triage and fix what it finds, then rescans to prove the fix before the pull request. Published at US$10 per user per month.	San Francisco application-security platform whose autonomous AI agents trace business logic and data flows to find exploitable code vulnerabilities, check dependency reachability and secrets, review pull requests with proposed fixes, and run agentic pentests against running applications, re-running each attack after a fix merges to confirm it is closed.	Australian 'autonomous system of agents' for product security that covers code, secrets, API pentesting and exploit validation. It proves findings with reproducible evidence, scores them against the customer's assets, writes merge-ready fix PRs routed to code owners, and runs remediation campaigns through Jira and Slack until merge, with the customer keeping final merge approval.	Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.	French AI code security platform (SAST, SCA, IaC, container and secret scanning) whose Cybe AutoFix agent reads the code graph, rewrites vulnerable lines or picks the safest dependency upgrade, tests the change in isolation and opens a bot-signed, CI-gated pull request for a human to merge.	Japanese security AI agent that continuously finds vulnerabilities with AI-SAST and AI-DAST (including logic, authentication and authorisation flaws), generates fix patches and opens pull requests with unit tests, and runs AI penetration tests that actually attempt intrusion to prove exploitability.	London AI code reviewer for GitHub and GitLab that reviews every pull request within minutes, flags security issues and suggests commit-ready fixes, fails the check on high-severity security findings so merging can be blocked, auto-approves low-risk PRs with no blocking findings, and scans whole repositories every night for vulnerable code, exposed secrets, misconfigured infrastructure and vulnerable dependencies.	Manchester software-change security platform that risk-scores every code change, automatically approves changes that fall within the customer's own policy and escalates the rest, then sends sandboxed AI pentest agents against high-risk changes and logs every decision and tool call as an audit-ready change record.	German AppSec product from Düsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.
Frameworks (vendor-stated)	—	—	—	SOC 2, ISO 27001	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—
Frameworks (vendor-claimed)	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	SOC 2, ISO 27001, ISO 42001 (vendor's own certification)	—	ISO 27001 (ISMS certification, vendor claim)	SOC 2 (vendor's own certification)	—	—
Capabilities / tasks	appsec, sast, remediation, vulnerability management, pr review	appsec, pr review, sast, vulnerability management	pr review, appsec, remediation	vulnerability management, appsec, remediation, sast, sca, secrets detection	appsec, remediation, sast, vulnerability management, iac	appsec, sast, remediation, code quality	pr review, appsec, sast, code quality, remediation	appsec, sast, remediation, vulnerability management, ide assist	appsec, sast, remediation, pr review, vulnerability management	appsec, sast, remediation, vulnerability management	appsec, sast, remediation, vulnerability management, sca	appsec, sast, secrets detection, sca, iac, remediation	appsec, pen test management, attack surface	pr review, appsec, code quality	appsec, sast, sca, secrets detection, remediation	appsec, sast, remediation, pr review, sca	appsec, remediation, sast, sca, vulnerability management	appsec, sast, sca, remediation, vulnerability management	appsec, sast, remediation, vulnerability management	appsec, sast, remediation, vulnerability management	appsec, vulnerability management, remediation, sast, sca	appsec, sast, sca, secrets detection, iac, pr review, remediation	appsec, sast, remediation, pr review, secrets detection, iac	appsec, sast, remediation, pr review	appsec, remediation, vulnerability management, agent platform with security integrations	appsec, sast, sca, secrets detection, pr review, remediation, pen test management	appsec, sast, sca, secrets detection, remediation, vulnerability management, pen test management	sast, sca, remediation, pr review, vulnerability management, appsec	appsec, sast, sca, secrets detection, iac, remediation, pr review	appsec, sast, remediation, pr review, pen test management, vulnerability management	pr review, appsec, sast, secrets detection, sca, iac, code quality	pen test management, appsec, risk assessment, workflow automation	appsec, sast, sca, secrets detection, iac, pr review, remediation, pen test management, cloud security
Pricing (as published)	Included with GitHub Code Security. Public repositories: available at no extra Code Security licence. Private/internal repositories: GitHub Code Security is published at $30 USD per active committer/month on github.com/security/plans. Not a Copilot seat add-on; GitHub docs say no Copilot subscription is required. Agentic autofix (GA 15 Oct 2026) is usage-billed: AI Credits from the Code Security budget plus Actions minutes; requires a Copilot billing method.	Included with Claude Code for users on individual paid plans (Pro or Max) and pay-as-you-go API Console accounts, per Anthropic’s help centre. Public Claude plan list prices are on claude.com/pricing; the GitHub Action uses a Claude API key.	Usage-based on Individual and Teams plans; no separate Bugbot subscription. Cursor’s Bugbot page states Individual plans use included usage first, Teams bill from on-demand usage, and the average review costs $1.00–$1.50 depending on PR size. Enterprise trials are arranged with the account team.	Published plans on snyk.io/plans (Free / Team / Enterprise style tiers; verify current amounts on the plans page).	Published plans on aikido.dev/pricing include a free option and paid team plans (Basic listed at $300/month for 10 users on the pricing page at last check). Confirm current amounts on the vendor pricing page.	AI CodeFix is a paid-edition feature (SonarQube Cloud Team/Enterprise; Server Enterprise/Data Center). Sonar’s plans page lists SonarQube Cloud Team from $32/month; Enterprise and Server commercial editions are quote or sales-led. Community Build does not include AI CodeFix.	Developer IDE plugin is $0. Team plan, which includes AI Reviewer, starts at $18 per developer/month billed annually ($21 monthly) on codacy.com/pricing. Business is custom.	Not verified	Free Edition: no charge for up to 10 contributors, 60 AI credits included, up to 10 private repositories. Teams starts at Code or Supply Chain $30/month/contributor and Secrets $15/month/contributor, with 20 AI credits per developer/month. Enterprise is volume/quote with 50 AI credits per developer/month. Figures from semgrep.dev/pricing at last check.	Requires GitLab Ultimate and a GitLab Duo add-on (Duo Enterprise or Duo with Amazon Q per docs). GitLab.com Premium is published at $29 per user/month billed annually with included GitLab Credits; Ultimate is listed on about.gitlab.com/pricing without a public dollar amount (sales/credits). Confirm current Duo add-on prices with GitLab.	Not verified	Free Tier with monthly limits; Amazon Q Developer Pro is $19 per user/month on aws.amazon.com/q/developer/pricing. Security scanning is a capability of those tiers, not a separately priced SKU on that page.	Quote-based	Free 14-day trial. Pro Team plan (designed for up to 30 users) is listed from $30 on qodo.ai/pricing with pooled credit packs at $0.012 per credit (for example 2,500 credits ≈ 18 reviews/month); Enterprise (30+ users, SSO, on-prem, BYOK) is custom. Confirm the billing unit on the vendor page.	Free plan listed on xygeni.io/pricing; paid annual plans are priced by number of contributors and daily scans (amounts load dynamically and were not captured from the static page).	Team plan starting from $1,000/month + $60 per developer (unlimited repositories and scans) on zeropath.com/pricing; Enterprise is custom; usage-based credits listed as coming soon; startup discounts up to 50%.	Not published as list prices. Pixee describes outcome-based pricing per 'resolution' (each automated triage or fix action), not per developer; custom quote.	Free Developer tier (AURI, no account required); Core and Pro tiers and add-on products are 'Get started' / 'Get pricing' with no list prices on endorlabs.com/pricing.	Not published	Not published	Not published (the pricing page shows no amounts).	Not published for Phoenix Purple specifically. The Phoenix pricing page lists platform plans (Free; Professional £1,495/month; Enterprise on request) but does not say which plan includes Purple.	Not published (demo request).	Not published	Wingman: US$10 per user per month, unlimited apps, 14-day free trial (no card). Scale plan: contact sales.	Not published	Not published. Nullify says it prices on work performed (scoped program and estimated volume), not seats or license tiers.	Not published. Enterprise platform by demo/quote; a no-commitment 'AISLE Snapshot' assessment is offered.	Free open-source Community edition and free trial; Cloud plans billed per developer and project (amounts not published); Enterprise on quote.	Published on flatt.tech/takumi: base fee JPY 70,000/month (excl. tax) including 250 credits shared across diagnosis, auto-fix and AI pentest, 15 Takumi Guard users and Runner minutes; overage JPY 280 per credit; a 30-day AI penetration test offer at JPY 980,000 (excl. tax, through end of 2026).	Open Source plan free for public repositories; Pro $12 per developer/month billed annually ($15 monthly); Team (code review and security, nightly scans of 50 repos) $24 per developer/month billed annually ($30 monthly); Enterprise (self-hosted, SSO, own LLM keys) via demo. 14-day free trial.	Not published	Published credit-based plans (amnify.ai/pricing, checked 2026-10-21): Free €0 (30 credits, 7 days, 1 repo, 1 cloud account); Starter €192/month (200 credits, 10 repos); Team €460/month (500 credits, 50 repos, 3 cloud accounts); Business €880/month; Enterprise on request. Extra credits €1 each. Each review, audit or pentest costs credits; no per-seat fees.
Pricing model	freemium	published-tiers	published-tiers	freemium	freemium	published-tiers	freemium	quote	freemium	published-tiers	quote	freemium	quote	published-tiers	freemium	published-tiers	quote	freemium	quote	quote	quote	quote	quote	quote	published-tiers	quote	quote	quote	freemium	published-tiers	freemium	quote	freemium
Primary source	https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning	https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code	https://cursor.com/docs/bugbot	https://snyk.io/plans/	https://www.aikido.dev/code/autofix	https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix	https://www.codacy.com/ai-reviewer	https://checkmarx.com/product/checkmarx-one-assist/	https://semgrep.dev/products/semgrep-multimodal	https://docs.gitlab.com/user/application_security/remediate/duo/	https://www.veracode.com/products/fix/	https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html	https://escape.tech/blog/introducing-cascade-the-multi-agent-penetration-testing/	https://www.qodo.ai/products/qodo-merge/	https://xygeni.io/dev-ai	https://zeropath.com/products/sast-autofix	https://www.pixee.ai/platform	https://www.endorlabs.com/platform/agentic-workflows	https://www.blackduck.com/signal-ai-appsec.html	https://www.hcl-software.com/appscan/products/rapidfix	https://cycode.com/maestro/	https://phoenix.security/phoenix-purple_ai_code_security/	https://www.kalpitatechnologies.com/products/kalpita-codeguard	https://docs.contrastsecurity.com/en/contrast-ai-smartfix.html	https://www.stackhawk.com/product/wingman/	https://depthfirst.com/	https://www.nullify.ai/	https://aisle.com/platform/autonomous-remediation	https://www.cybedefend.com/en/cybe-autofix	https://flatt.tech/takumi	https://sourcery.ai/security	https://cytix.io/solutions/agentic-pentesting	https://amnify.ai/
Last checked	2026-10-21	2026-10-18	2026-10-18	2026-10-20	2026-10-18	2026-10-19	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-18	2026-10-19	2026-10-19	2026-10-19	2026-10-19	2026-10-20	2026-10-20	2026-10-20	2026-10-21
Official site	https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning	https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code	https://cursor.com/docs/bugbot	https://snyk.io/	https://www.aikido.dev/code/autofix	https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix	https://www.codacy.com/ai-reviewer	https://checkmarx.com/product/checkmarx-one-assist/	https://semgrep.dev/products/semgrep-multimodal	https://docs.gitlab.com/user/application_security/vulnerabilities/	https://www.veracode.com/products/fix/	https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html	https://escape.tech/	https://www.qodo.ai/products/qodo-merge/	https://xygeni.io/dev-ai	https://zeropath.com/products/sast-autofix	https://www.pixee.ai/platform	https://www.endorlabs.com/platform/agentic-workflows	https://www.blackduck.com/signal-ai-appsec.html	https://www.hcl-software.com/appscan/products/rapidfix	https://cycode.com/maestro/	https://phoenix.security/phoenix-purple_ai_code_security/	https://www.kalpitatechnologies.com/products/kalpita-codeguard	https://docs.contrastsecurity.com/en/contrast-ai-smartfix.html	https://www.stackhawk.com/product/wingman/	https://depthfirst.com/	https://www.nullify.ai/	https://aisle.com/	https://www.cybedefend.com/en/cybe-autofix	https://flatt.tech/takumi	https://sourcery.ai/security	https://cytix.io/	https://amnify.ai/

Coding platforms that only reach this category through a scanner integration are tagged agent platform with security integrations and are omitted from this table so they are not presented as dedicated AppSec products: Tembo, Devin, Factory Droids, GitHub Copilot coding agent, OpenHands Vulnerability Fixer (agent platform with security integrations), Kiro (agent platform with security integrations), Replit Security Agent (agent platform with security scans, AI pentest and Agent autofix).

Use-case comparisons

• Agentic pentesting AI agents — 33 listings (Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification)

Related

• GitHub Copilot Autofix alternatives
• Claude Code security review alternatives
• Cursor Bugbot alternatives
• Snyk alternatives
• Aikido AI AutoFix alternatives
• SonarQube AI CodeFix and Remediation Agent alternatives
• Codacy AI Reviewer alternatives
• Checkmarx One Assist alternatives
• Semgrep Multimodal alternatives
• GitLab Duo Vulnerability Resolution alternatives
• Veracode Fix alternatives
• Amazon Q Developer security scanning alternatives
• Escape (AI pentesting and DAST) alternatives
• Qodo multi-agent code review alternatives
• Xygeni DevAI and CoreAI (agentic AppSec) alternatives
• ZeroPath (AI-native SAST and autofix) alternatives
• Pixee (automated triage and fix) alternatives
• Endor Labs security agents (agentic triage and remediation) alternatives
• Black Duck Signal (agentic AI AppSec) alternatives
• HCL AppScan RapidFix alternatives
• Cycode AI Teammates (Exploitability, Remediation and Change Impact agents) alternatives
• Phoenix Purple (Phoenix Security) alternatives
• Kalpita CodeGuard alternatives
• Contrast AI SmartFix (agentic vulnerability remediation) alternatives
• StackHawk Wingman (find-fix-verify security for AI coding agents) alternatives
• depthfirst autonomous security agents (code, supply chain, secrets and agentic pentesting) alternatives
• Nullify autonomous product-security agents (find-to-fix with merge-ready PRs and AI Pentest Agent) alternatives
• AISLE (autonomous vulnerability discovery, triage and verified-fix agents) alternatives
• CybeDefend Cybe AutoFix (AI code security agent that opens tested fix pull requests) alternatives
• Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing) alternatives
• Sourcery AI code review and security scanning (PR review bot with merge-blocking security checks, auto-approval of low-risk PRs and nightly codebase scans) alternatives
• Cytix agentic pentesting and automatic change approvals (change-driven software security) alternatives
• Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) alternatives
• Best code security AI agents