AWS launches Continuum to automatically repair code vulnerabilities

Automated security patching

Amazon Web Services (AWS) recently made Continuum generally available to help developers secure their software. The tool is designed to find and validate bugs within code repositories while checking them against a user's specific AWS environment. Once a flaw is identified, the system automatically opens a pull request containing a proposed fix.

The service aims to streamline the security lifecycle by moving from simple detection to active remediation. According to the news reported by thenewstack.io, the tool is intended to help defenders manage the growing volume of software vulnerabilities. It acts as an autonomous agent that can navigate a codebase to find where things are breaking.

By integrating directly with the development workflow, Continuum attempts to bridge the gap between finding a problem and solving it. Instead of just alerting a human to a risk, it provides a tangible starting point for the repair. This shift toward automated remediation is a key focus for cloud providers looking to harden infrastructure.

The 89% success benchmark

AWS published a headline benchmark showing that Continuum achieved an 89% end-to-end success rate on the CyberGym-E2E test. This score is significantly higher than the previous public high of 65.9% recorded by other AI agents. The test gave the agent 90 minutes to find and fix a vulnerability in one of 139 open-source projects without any prior hints or logs.

To earn this score, the agent had to successfully identify a flaw, trigger it, and produce a fix that stopped the crash. Crucially, the fix had to work without breaking any of the project's existing tests. AWS noted that if the agent were given more time than the 90-minute limit, the success rate rose to 93.7%.

Matt Garman, the CEO of AWS, stated on X that AI is "genuinely transformative for defenders" regarding these capabilities. However, the benchmark results are currently unique to AWS, as they performed the tests themselves. They confirmed the agent followed the rules, including limits on internet access, and did not simply look up existing public fixes.

Technical limitations and scope

While the 89% figure is impressive, the benchmark has specific constraints that define its scope. All tasks in the CyberGym-E2E test involved memory-safety bugs in C or C++. This means the tool may not perform the same way on other programming languages or different types of security vulnerabilities.

There is also a notable gap between finding a bug and fixing a specific historical one. Continuum successfully patched a real vulnerability in 89% of tasks, but it only fixed the specific historical bug the benchmark was looking for in 37.8% of cases. This discrepancy exists because a repository can contain multiple flaws, and the agent was not told which specific one the benchmark prioritized.

The difference in scores suggests that while the agent is proficient at finding and fixing any bug, it is less likely to hit a specific target on its first try. AWS acknowledges that fixing a different vulnerability still provides value to the user. However, the results do not yet show how the tool performs when a human team gives it a specific, targeted vulnerability to repair.

Validation and future outlook

The grading process for these runs involves four cumulative stages to ensure the quality of the AI's work. The agent must first find and reproduce the bug, which it did in 92.5% of the tasks. It then must stop the crash and ensure the project's tests continue to pass, which it achieved in 89.6% and 89.0% of the cases, respectively.

Because the agent does not know which historical bug the benchmark is testing for, it must navigate the codebase blindly. This highlights the current state of AI security: it is becoming very good at general problem-solving but still struggles with specific precision. The tool's ability to navigate complex repositories without a crash log or proof of concept is a significant step forward for automated defense.

Moving forward, the industry will likely watch how Continuum performs in diverse production environments beyond the C and C++ languages. As AI makes it easier to find vulnerabilities, the pressure on tools like Continuum to provide reliable, accurate fixes will increase. For now, the tool serves as a high-performing starting point for automated security auditing in the cloud.