Snyk's new security agents follow one rule: the agent that writes the fix never grades it

If a coding agent writes a vulnerable function and a second agent, built on a similar model, is asked whether the function is safe, how independent is that second opinion? Snyk’s own benchmark gives a reason to doubt it: in what it calls VulnBench, LLM security reviews reported a finding that disappeared on the next run 49.7% of the time. A reviewer that changes its mind half the time is not a control.

Snyk’s answer, in the Evo Agentic AppSec launch on October 15, is stated in one line by its leadership: “The generator cannot be the validator.” The agents do the work; Snyk’s deterministic engines, such as Snyk Code and Snyk Open Source, are called as tools to check it; and its offensive testing product attacks the running application to confirm that fixes hold. “None of the agents grade their own work,” the announcement says.

What was announced, and how ready each part is

Evo is a set of specialized agents, and they are not at the same maturity. Reading the launch as “Snyk now fixes everything with agents” would be a mistake.

Evo, by availability

Selected customersGenerally available

1. Experimental previewCode Scanning Agent, Dependency Firewall, Agentic Security Review
2. Open previewRemediation Agent, starting with Snyk Open Source issues
3. GASecrets Detection, Agentic Development Security, Continuous Offensive Security

• The Code Scanning Agent combines model reasoning with static analysis to look for logic flaws such as broken access control.
• The Dependency Firewall blocks malicious or out-of-policy packages at install time, including slopsquatting, where attackers publish packages under names that models tend to hallucinate.
• Agentic Security Review reviews a whole repository with an application model, a threat model and evidence-backed findings.
• The Remediation Agent runs the fix loop across new code and the backlog.

Approval follows consequence

Snyk draws a line worth copying. Prevention inside the coding agent, catching a problem before the code is written, needs no human sign-off. Remediation of existing code does: a fix that might break the build is queued for approval, not merged. Developers approve fixes, and AppSec leads govern the agents and audit their decisions. Snyk’s summary: “Agents do the work. Something independent proves it holds. Humans own the bar.”

That is the same boundary GitHub drew the same day, when it made Agentic Autofix and AI Scan generally available without letting either merge or block anything. Two vendors arriving at one design in one week is a signal about where the industry thinks AI security authority should stop.

Independent of what, exactly?

“Independent verification” is easy to claim, so it is worth asking what makes a check independent:

1. A different method. A rule engine, a test suite or an exploit attempt fails in different ways than a language model. Another model, prompted differently, often does not.
2. A different owner. The team that tunes the verifier should not be the team measured on how many fixes ship.
3. Repeatability. Run the same check twice and get the same answer. Snyk’s VulnBench figure is the warning about checks that fail this test.

This is the principle we argued for regulated systems: proof has to come from outside the model. Snyk applies it to application security and makes it a product feature.

Read the numbers as Snyk’s

The launch carries many vendor-reported figures: new critical and high-severity issues up tenfold in a year, about eight new vulnerabilities introduced for each one fixed, and its Remediation Agent producing mergeable fixes 90% of the time against 59.6% for LLMs alone on its VulnBump benchmark. Snyk also reports that 36% of nearly 4,000 agent skills it audited had at least one security flaw, which matters for anyone sharing skills across agents. None of these has been independently replicated.

For buyers, the useful test is not any single number. It is whether a vendor can show, for each agent it sells, which independent mechanism checks that agent’s output, who approves what it changes and what happens when the two disagree.