Datadog Bits AI Dev Agent: Automated Vulnerability Remediation at Scale

The average enterprise application backlog of unresolved static analysis findings numbers in the thousands. Datadog just built an AI agent that closes them automatically.

Bits AI Dev Agent for Code Security is a new capability inside Datadog Code Security that moves from vulnerability detection to automated remediation. Instead of surfacing findings for security engineers to triage and developers to fix manually, the agent generates code-level fixes and opens pull requests for review — shifting the bottleneck from identification to approval.

Context

The gap between finding a vulnerability and fixing it is where most security programs stall. Static analysis tools are good at producing findings; they are poor at helping organizations work through them at the rate they accumulate. A backlog of 3,000 SAST findings is not a tool problem — it is a capacity problem. No security team has the cycles to triage and remediate at that volume manually, and development teams rarely prioritize security tickets over feature work.

The pattern emerging across enterprise security tooling in 2026 is AI across the full vulnerability lifecycle: AI-native detection, LLM-based false-positive filtering, and now automated remediation with human oversight preserved. Bits AI Dev Agent is Datadog’s implementation of that last step.

The Detail

The agent operates through two primary modes.

Single-fix remediation targets individual findings from Datadog’s Static Application Security Testing (SAST) scanner. A security engineer reviews a proposed code fix directly in the Datadog interface, can interact with the agent to refine the suggestion, and then triggers PR creation on GitHub — without requiring a developer ticket or context switch.

Batch remediation addresses the backlog problem at scale. Teams define sets of vulnerabilities for simultaneous remediation, specifying grouping strategies by repository, file, or individual finding. The agent determines appropriate PR quantities matched to the development team’s review capacity, then creates those PRs in a single operation. What would previously require thousands of manual PR creations becomes a single configuration step.

The underlying detection layer combines two scanning approaches: traditional rule-based analysis for well-characterized vulnerability classes, and an AI-native scanner that applies LLM analysis to filter false positives before findings reach the remediation queue. Issues are mapped to CWE entries and OWASP Top 10 categories. Datadog cites SQL injection and command injection as example vulnerability classes addressed, across JavaScript, Node.js, and Python codebases.

Every remediation action generates a session in a central dashboard — a 1:1 mapping of sessions to pull requests — showing associated findings, code diffs, and PR status. A Batches view tracks larger remediation campaigns: counts of remediations completed, PRs open, approvals, and merges across parallel initiatives. The design maintains human review throughout; the agent creates PRs, but engineers approve and merge.

In March 2026, Datadog also achieved ISO 42001 certification for responsible AI — the standard covering AI management systems — providing an external accountability marker for organizations with compliance requirements around AI-assisted tooling.

Source: Datadog Blog

Content created with AI assistance and reviewed for accuracy.