AWS Delivers AI Service to Discover Vulnerabilities and Generate Patches

Amazon Web Services (AWS) has made generally available a service through which it finds and validates code vulnerabilities and provides a patch that DevSecOps teams can then automatically apply or set up a pull request to implement.

Dr. Neha Rungta, director of applied science at AWS, said the AWS Continuum service for code vulnerabilities is designed to enable DevSecOps teams to keep pace with the growing rate at which vulnerabilities in the age of artificial intelligence (AI) are now being discovered. Instead of having to manually build, test and validate each patch, it’s now possible to automate that process, she said.

Announced earlier this year, the AWS Continuum service is based on an AI agent and context graph that discovers, validates and prioritizes vulnerabilities that are then used to surface a remediation recommendation. There is also a tool to automatically create threat models for codebases that are used to provide a learn mode for the AWS Continuum service, said Rungta.

Armed with those insights, the Continuum service can assess whether a vulnerability is reachable and what a threat actor might be able to reach from it. Additionally, Continuum identifies which systems are business-critical, who owns them, how services depend on one another, and which data each one is able to access.

Collectively, those tools make it possible to run code reviews, generate threat models, and remediate findings directly from within an integrated development environment (IDE) or command line interface (CLI) by invoking the Model Context Protocol (MCP).

Each DevSecOps team will, of course, need to decide how much confidence they have in a patch created by an AI agent, but AWS Continuum is unique in that it understands the context of the AWS cloud computing environment where that patch will run, said Rungta.

That’s critical because increasingly cybercriminals are now able to reverse engineer a vulnerability to create an exploit in a matter of minutes. Existing manual processes for creating, validating and deploying a patch are about to be overwhelmed, added Rungta. 

There is, of course, no such thing as a silver bullet for cybersecurity, but in time, the management of patches will become much more autonomous as DevSecOps teams gain more confidence in the output generated by AI tools, she said.

In the meantime, however, the pace at which a patch can be developed and deployed will become much more manageable as it becomes simpler to prioritize which patches may need to be applied immediately versus waiting until the next maintenance cycle because other controls are in place, noted Rungta. In effect, application security remains a game of checks and balances, she added.

Hopefully, there will come a day when patches for vulnerabilities are created the moment they are discovered. Until that day, developers, whether they like it or not, will need to devote more time and resources to fixing legacy applications versus building new features using AI coding tools that might very well add more vulnerabilities to an application environment—vulnerabilities that will also need to be fixed sooner or later.