Theses›Software & applications›Autonomous remediation

Autonomous remediation

Fixing becomes the bottleneck once AI makes finding free, and the patch-writing agent is the product

  • Bear
  • Early
  • $43B by 2035

The callAI now finds bugs far faster than people fix them: only 516 of 6,157 lab-disclosed vulnerabilities had been patched by Oct 2026. Fixing is the gap, the AI labs and GitHub are moving in, and the window is early.

D1D2D3D4R1R2R3C1C2C3foragainst D1D2D3D4R1R2R3C1C2C3foragainst
Fig. 1The balance. Drivers and catalysts against restraints, each block sized by its weight; catalysts hang dashed because they have not happened yet, sized by their odds. It tips toward the restraints.
  1. D1One lab's disclosure programme found 6,202 high or critical bugs across about 1,000 open-source projects, and maintainers asked it to slow down.
  2. D2Four dedicated remediation companies raised between $11M and $37M each in 2026.
  3. D3J.P. Morgan reads security spending as shifting from detection to remediation, with AI-enabled companies taking 72% of security financings through May 2026.
  4. D4The EU Cyber Resilience Act's vulnerability-handling duties could put deadlines on patching.
  5. R1The AI labs that find bugs are paying to fix them too, with $1bn of model access on one side and a $35M fund on the other, so a free competitor is plausible.
  6. R2GitHub fixes code inside the code host, so Microsoft has both the model and the place the code lives.
  7. R3No remediation company publishes revenue, and no buyer has shown a fix budget separate from finding.
  8. C1A lab disclosure report shows more than half of its disclosed vulnerabilities patched.30 Jun 2027
  9. C2An independent remediation company is acquired for more than $500M or raises at more than $1B.31 Dec 2027
  10. C3A breach with a named loss is traced to a bug left unpatched more than 30 days after disclosure, or a regulator sets a patch deadline.31 Dec 2027
Rests onthe beliefs underneath
Supported by · confidence
What would prove itdated tests, open and resolved
20272028today12345predictionswatch 20272028today12345predictionswatch
Fig. 2Each ring is a dated test: dashed while open, struck through when overdue, ticked or crossed once resolved.
  1. 1By 30 Jun 2027 Anthropic's Glasswing (or a successor report) shows more than half of lab-disclosed vulnerabilities patched, up from 516 of 6,157 in Oct 2026.Jun 2027 · open
  2. 2The patch rate on lab-disclosed vulnerabilities, against half.Jun 2027 · open
  3. 3By 31 Dec 2027 at least one independent remediation company is acquired for more than $500M, or raises at more than $1B.Dec 2027 · open
  4. 4Whether the AI labs ship the deploy step themselves or leave it to partners.Dec 2027 · open
  5. 5An acquisition above $500M or a valuation above $1B for an independent remediation company.Dec 2027 · open
Expressionslisted, private, technologies
What changedthe record, newest first
  • 23 Oct 2026AI finds bugs faster than anyone can fix them. The product that writes and ships the fix is the gap, and the labs that find the bugs are already moving in to close it.