Snyk-agent-scan execution risks
Snyk-agent-scan (v0.4.3) executes MCP server commands from an mcp.json configuration file without asking for user consent or showing the command to the user. This behavior allows an attacker to run arbitrary code with the user’s privileges. When a developer runs this tool to evaluate an untrusted configuration, the scanner parses the file, finds the mcpServers entry, and executes the command array via stdio. In one reported instance, a malicious configuration exfiltrated the hostname, user, and current working directory to a callback server. The tool suppresses server output by default via the –suppress-mcpserver-io=True flag. This hides the evidence of execution from the terminal. Additionally, the scanner auto-discovers globally configured MCP servers and transmits tool descriptions to the invariantlabs.ai analysis API without a prompt for data transmission. The researcher submitted the report on February 28, 2026, and Snyk offered a $100 bounty for the disclosure. Snyk initially closed the report in April 2026, citing an "accepted risk" because it matched the behavior of the Snyk CLI. The company reopened the report and committed to prompting the user before executing MCP binaries after significant pushback. This flaw undermines the tool’s purpose.
Accuracy and the noise problem
Security teams struggle with high noise levels as AI-generated code volume increases. Xygeni’s 2026 SAST benchmark measured Snyk Code at a 34.55% false-positive rate when tested against the OWASP Benchmark suite. This means roughly one in three flagged issues in that specific test set did not represent a real vulnerability. Aikido research found that its platform produces 85% fewer false positives than Snyk. You probably already know that alert fatigue causes developers to ignore vital security findings. Snyk claims its proprietary database catches CVEs 47 days before public sources like the NVD, but the volume of flaws in AI code remains high. A Blueradius review found that 78% of GitHub Copilot-generated enterprise code carried at least one exploitable vulnerability that scanners missed. The 2025 disclosure of over 48,000 CVEs demonstrates the massive scale of the current vulnerability landscape. GitGuardian’s March 2026 report found that AI-assisted commits carried a 3.2% secret-leak rate. In comparison, SonarQube hit as low as 1% false positives under a specifically tuned rule configuration, while Checkmarx claims its AI-hybrid engine achieves a 60% reduction in false positives. Does the rise in AI code generation outpace the ability of these scanners to achieve precision?
Snyk Agent Fix and the agentic flow
Snyk Agent Fix uses an agentic architecture that combines Snyk proprietary intelligence with large language models. The system follows a specific pipeline: the static analysis engine identifies a vulnerability, the prompt enrichment stage retrieves relevant human-written fix examples, the LLM generates candidate fixes, the static analysis engine verifies the fix, and the agentic retry loop attempts corrections if the fix fails. The system uses dynamic few-shot prompting with a database of 35,000 expert-written fixes to provide context during inference. If a generated fix fails a Snyk Code scan, the agentic retry loop analyzes the error and attempts a corrected version. This process takes a median time of under 8 seconds, though large files with multiple retries can take up to 2 minutes. Snyk Agent Fix focuses on single-file fixes and cannot resolve vulnerabilities spanning multiple files. The tool provides code fixes for vulnerabilities like SQL injection, XSS, and command injection, though it does not provide automated remediation for all findings. Users must review every suggestion to ensure it aligns with the broader application architecture. Snyk also launched Evo Continuous Offensive Security in August 2026 to provide autonomous, AI-powered penetration testing and agent red teaming for enterprises. Snyk Studio also provides scanning for AI-generated code in tools like Cursor and Claude Code.
