Snyk launches Evo security agents with an open remediation preview

Security agents get distinct release stages

Snyk announced Evo Agentic AppSec on October 15 as a team of AI security agents intended to find, fix and block vulnerabilities in both agent-written and existing human-written code. The concrete buying and adoption detail is that the lineup does not share one availability status.

Evo Remediation Agent is available in open preview, starting with Snyk Open Source issues. Evo Code Scanning Agent, Evo Dependency Firewall and Evo Agentic Security Review are experimental previews for selected Snyk customers. Secrets Detection, Evo Agentic Development Security and Evo Continuous Offensive Security are generally available; those existing components should not be mistaken for three newly opened previews.

The company directs organizations to their account representative for access. Its announcement does not give a public price for the new lineup or establish that every preview is included in every Snyk plan.

Finding a problem is only part of the loop

Snyk says the agents operate its existing engines, including Snyk Code and Snyk Open Source, rather than replacing those engines with general-purpose model judgments. Code Scanning Agent combines reasoning with static analysis; Dependency Firewall targets malicious or out-of-policy packages at installation time. Agentic Security Review is described as building application and threat models from repository code and context to produce evidence-backed findings.

For remediation, the company describes an agent that works through a fix loop across new issues and an existing backlog. A fix that might break the build is queued for approval rather than merged, according to the release. That distinction matters for teams deciding how much authority to delegate over code already in production.

A separate validator is a design claim

The announcement says results are verified independently of the agent that produced them. Snyk positions its Continuous Offensive Security product as a separate judge that attacks the running application to check whether fixes hold. Here, independent means separation within Snyk’s described workflow; it is not a claim that an outside organization has audited every generated fix.

Snyk promotes the system as a route toward clearing security backlogs and reports its own benchmark results. AITrending has not reproduced those measurements or evaluated the agents against a live application. This report is based on the company’s English press release, marked as paid distribution on Yahoo, rather than independent product testing. The supported news is the launch, the described division between generation and validation, and the specific preview boundaries teams must navigate.