AWS Continuum goes GA: AI checks which code bugs are actually exploitable, then files the fix as a pull request

#What happened

AWS announced general availability of Continuum for code vulnerabilities on Oct 22, 2026. The service discovers, validates, prioritizes, and remediates code vulnerabilities.

It builds a context graph from two sources: the customer's code repositories (GitHub integration or an Amazon S3 bucket) and the AWS environment (a collector gathers AWS Config resources and network configuration), so it can tell whether a vulnerable path is actually reachable over the network.

From the graph it learns which systems are business-critical — customer data stores, payment pipelines, authentication services — and ranks each issue by how close its attack path runs to those systems, rather than relying on generic severity scores.

Each finding gets an evidence level. When Continuum can reproduce a bug, it runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps, the attack path, and a blast-radius assessment.

For each confirmed issue it generates a fix — a code patch, a dependency upgrade, or a configuration change — and opens it as a pull request in the connected repository. Every fix requires human approval today: you review and merge. AWS describes a Learn mode (proposes fixes for a person to approve) with a future path to an Enforce mode that applies fixes automatically once confidence gates pass.

It works alongside Amazon GuardDuty and AWS Security Hub. The announcement includes no pricing and no regional availability list.

AWS framed it as a response to attacker speed: threat actors can turn a vulnerability disclosure into working exploit code in minutes using frontier AI models.

#Why it matters

This is the agentic-security direction playing out across the stack: the same week OpenAI pushed its Codex Security Cloud for GitHub scanning, AWS is pushing validated, evidence-backed remediation inside its own cloud. The shift is from raw alert volume to proven exploitability with a fix attached.

Verified Oct 23, 2026.