Checkmarx has launched self-healing autonomous brokers in its Help product household, designed to detect, repair and confirm software program vulnerabilities as builders write code.
The replace centres on Developer Help, which now runs what Checkmarx describes as a steady find-and-fix loop inside AI coding instruments earlier than code is dedicated. Utilizing hooks and MCP, the product retrieves context from Checkmarx One, generates a repair after which verifies it.
The most recent model is geared toward groups utilizing AI coding instruments as software program technology hastens. Checkmarx’s 2026 Way forward for Software Safety report discovered that 96% of builders now use AI coding instruments, whereas 18% apply safety repeatedly as they write code.
Analysis cited by Checkmarx pointed to a niche between code technology and safe output. In a examine commissioned from impartial researcher The Climate Report, frontier fashions produced working code 83% to 95% of the time, however solely 24% to 36% of that code was each safe and practical.
A later safety evaluation raised the secure-and-functional price to 47% to 56%, however Checkmarx argued that also left software program groups with a big remediation burden. Its response is to maneuver remediation earlier within the growth course of reasonably than depend on checks after code has already been written.
Developer Help is meant to work inside coding environments together with Cursor, Windsurf and Kiro, in addition to command-line workflows utilizing giant language mannequin instruments corresponding to Claude Code. The system is designed to identify a vulnerability, suggest a restore and ensure the consequence with out requiring builders to depart their present instruments.
Checkmarx mentioned the newest replace can cut back guide remediation effort by as much as 70% for dependency and package-upgrade work, chopping a typical six-hour bundle improve to 1.8 hours.
Backlog focus
As soon as code has entered the backlog, Triage Help and Remediation Help take over. The brokers are designed to kind vulnerabilities utilizing real-world reachability, which Checkmarx calls attackability, after which create pull requests for builders to evaluation and merge.
Builders stay liable for approving every repair, whereas utility safety groups retain coverage management and a file of automated selections. The method displays rising demand for instruments that cut back developer workload with out eradicating human oversight from safety modifications.
“Safety groups have spent a decade attempting to maintain tempo with how briskly code will get written, and AI simply moved that goalpost once more,” mentioned Harshil Parikh, Vice President of Product Administration at Checkmarx. “The one technique to shut that hole is to cease treating detection and remediation as separate steps dealt with by separate instruments and let the system repair what it finds.”
Jonathan Rende, Chief Product Officer at Checkmarx, mentioned the launch is meant to cease safety points from reaching manufacturing methods. “The purpose is prevention – making a steady move of fresh code from the beginning and autonomous fixes earlier than code reaches manufacturing,” he mentioned. “With autonomous remediation, fixes are utilized whereas builders are nonetheless writing code, earlier than it is ever checked in, and what’s within the pipeline will get prioritized and expedited with out having to consider it.”
Buyer use
PatientPoint, a healthcare expertise firm and present Checkmarx buyer, has been an early person of Remediation Help, in line with Checkmarx. Its utility safety staff used the instrument to scale back a big vulnerability backlog right into a smaller set of merge-ready pull requests for builders.
The use case highlights a broader subject for software program groups as AI-assisted growth will increase the amount of code modifications and the variety of points requiring evaluation. Safety groups are below stress to maintain tempo with out delaying releases or growing prices.
“Triage and Remediation Help brokers recognized false positives and gave our builders the prospect to evaluation earlier than merging; that is precisely what we needed,” mentioned Femi Oyesanya, Software Safety Engineer at PatientPoint. “Our precedence is to guard affected person knowledge, and this lets us do this with out slowing developer productiveness or driving up token prices.”
Checkmarx mentioned Developer Help’s autonomous mode, together with Triage Help and Remediation Help, is mostly out there by way of Checkmarx One.