Amazon launches AI tool that finds real security holes and drafts fixes

Amazon Web Services has made AWS Continuum for code vulnerabilities generally available. It is a security service that uses AI to find flaws in software code, test which ones an attacker could actually use, and propose a fix for each. A person has to approve every fix before it ships.

What changed

Security scanners can produce thousands of alerts a day, and many need no action. A flaw may be unreachable, impossible to exploit, or already blocked by another protection. AWS says confirming a real problem used to take hours of manual investigation. Shipping a safe fix could take days of coordination between security, infrastructure and application teams.

AWS also points to a growing risk. It says attackers using advanced AI models can turn a public vulnerability notice into working attack code in minutes.

How it works

Continuum builds a map from two sources: your code repositories and your AWS environment. For the AWS side, you set up a collector in the account and Region where your code runs. The map shows which systems matter most, who owns them and what data they touch. Issues are ranked by how close an attack path runs to systems such as customer data stores, payment pipelines and login services.

For problems it can reproduce, Continuum runs the attack in an isolated test area called a sandbox. It attaches the proof and the steps to repeat it. It also checks whether your existing defenses would catch the attack.

What the fixes look like

• A fix can be a code patch, a software update or a settings change.
• It arrives as a pull request, which is a proposed change your team reviews and approves.
• Your team reviews and merges it, so the final decision stays with people.
• In AWS's example, one fix touched four files, adding 50 lines and removing 24.

To start, you connect a code source, either GitHub or an Amazon S3 storage bucket. You then create an environment that scans it on a schedule you choose.

Who it affects

The service is aimed at organizations with large collections of applications, especially those running their own custom software. The pitch is less time spent chasing false alarms and faster fixes for the problems that are real.

What is not known yet

AWS says that in the future, teams will be able to let Continuum apply certain kinds of fixes on its own. That would happen only after safety checks pass, such as test coverage, limits on scope and past success rate. That option is not available now. The announcement material does not cover pricing or which regions are supported.