AWS Continuum sets a new standard in autonomous code security

What it is

AWS Continuum for code vulnerabilities is a multi-agent system (AWS product) that autonomously finds, proves, and patches memory-safety bugs in C/C++ projects. The page details the system's internal architecture and the CyberGym-E2E benchmark's scoring mechanics — specifics the existing summary's headline numbers don't carry.

How it works

Continuum is organized into three phases mapped to specialized agent sets, each passing evidence forward:

• Discovery: agents analyze the repo, flag candidate code paths, and record source evidence for each.
• Validation: separate agents build a proof-of-concept exploit, run it against the vulnerable binary, and confirm the crash supports the candidate finding — converting a hypothesis into executable evidence.
• Remediation: agents trace the confirmed vulnerability to root cause, write a patch, then verify the patch both blocks the PoC and keeps the project's functional tests passing.

The architecture lets AWS swap tools, prompts, and even models per phase, and explicitly supports using multiple models for complementary strengths rather than a single model end-to-end.

flowchart LR
    A[Discovery: candidate findings] --> B[Validation: PoC + crash evidence]
    B --> C[Remediation: root-cause patch]
    C --> D{S3: tests still pass?}
    D -->|yes| E[S4: matches historical vuln?]
    D -->|no| F[Fail - revert/retry]

Preconditions / Affected

Scope is deliberately narrow: memory-safety vulnerabilities in C/C++ only, sanitizer-detectable crashes, evaluated in an isolated container with no network access and no ability to modify protected benchmark files. The agent gets zero hints — no CVE description, PoC, crash log, or original patch. AWS states this leaves out "many of the most common and impactful bug classes observed in production systems" and most languages.

What to do

No install/config steps are given (this is a benchmark report, not a deployment guide). The actionable detail for evaluators: AWS ran the benchmark under CyberGym-E2E's network-isolation and submission-review rules, and did post-run trajectory review specifically to confirm wins came from genuine vulnerability analysis rather than the agent retrieving public historical fixes during execution — a reproducibility/integrity check worth noting if assessing the claimed numbers.

Caveats

AWS explicitly flags what the benchmark does not test: deployment context (service exposure, network paths, permissions, config) that would normally determine real-world prioritization — Continuum can use this in customer environments, but CyberGym-E2E doesn't score it. S4 (matching the specific historical CVE) is noted as diagnostic-only, since a codebase can contain multiple valid vulnerabilities and an agent may legitimately find/fix a different real flaw than the one the benchmark selected. The 93.7% uncapped figure is a secondary result outside the official 90-minute-limited measure.