VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

Summary

Snyk published VulnBump, a benchmark of 307 real upgrades of vulnerable dependencies across six package managers (Maven, Gradle, npm, Yarn, pip, Poetry). A task passes only if the vulnerabilities are gone, the project installs, builds, and passes its tests. Snyk's Evo Remediation Agent passed 90.2% of upgrades on Claude Sonnet 5.5, versus 77.5% for Claude Code with Snyk's recommended upgrade and scan and 59.6% for Claude Code unaided.

Topics

• AI agents

Related items

• InfoAnthropic flags revenue surge to investors ahead of stock market debutSame vendor · BBC Technology
• InfoAnthropic's third-quarter revenue is said to hit $16.8 billion ahead of IPO Same vendor · CNBC Technology
• InfoTree AppreciatorSame vendor · Simon Willison's Weblog
• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSame vendor · Dark Reading
• InfoBank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's MythosSame vendor · CNBC Technology