VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

Can AI agents fix vulnerable dependencies without breaking the build? The fix itself is rarely the mystery. Over six months in 2026, Snyk Open Source recorded 459 million vulnerability findings across ~300,000 organizations. 94% of these vulnerabilities had a known fixed version, yet only about 10% had been resolved. That happens because the hard part is upgrading safely: most vulnerable packages are transitively imported, about a quarter of fixes require a major version bump, and even minor and patch releases, which are supposed to be backward compatible, often contain breaking changes. VulnBump, new research we published at Snyk, puts AI agents to the test on 307 real upgrades of vulnerable dependencies. An upgrade counts as a PASS only if the vulnerabilities are gone and the project still installs, builds, and passes its tests. What's new: to our knowledge, VulnBump is the first benchmark for AI agents built around security-driven upgrades: every task starts from real vulnerabilities that Snyk found in a real project, across six package managers. Earlier upgrade benchmarks check only for breakage, not whether the vulnerability is gone. So, can AI agents fix vulnerable dependencies without breaking the build? Mostly, yes, but the model alone doesn't decide it.…