Hacktron Automation Turns Vulnerability Findings Into Fix PRs

Hacktron AI, whose agent already reviews code for security vulnerabilities, has added Automation, a feature that drafts the fix as well. A team sets its rules once: where the automation runs, which findings qualify, and who gets notified. When a new finding matches, Hacktron says its agent confirms that the vulnerability is real and exploitable, writes a fix, and, according to the launch video, opens a pull request for the team to review.

The verification step is the core of the pitch. In the video, Hacktron says the agent checks a vulnerability with dynamic checks, meaning it runs the code rather than only reading it, before it writes anything, and that it understands a project's repositories, test suite and tech stack well enough to execute and test the code end to end. A patch for a finding that turns out not to be real wastes a reviewer's time, so confirming exploitability first is how Hacktron says it gets fewer false positives along with faster patches. The video describes every automation as a trigger that decides when it runs, an action that decides what it does, and a notifier that tells the team what happened, with remediation as the first action available.

The supporting numbers are Hacktron's own. In the video it says it has run more than 100,000 security reviews in the three months since it started and that more than 85% of its findings are actionable on average, without saying how actionable is judged. Neither the collected text of the launch post nor the video's transcript gives any measure of how often the generated fixes are correct or get merged. What the feature changes, by Hacktron's description, is the human step: engineers review a pull request instead of writing the patch. Hacktron's MCP tool takes a different route to the same job, letting a developer's own coding agent such as Claude Code, Codex or Cursor fetch Hacktron's findings for a pull request and write the fixes.