Breaking

Vercel Open-Sources deepsec, an AI Agent That Hunts Code Vulnerabilities

June 28, 2026 at 15:45 EDT

Security
AI Agents
Software Dev & Coding

Vercel Labs on May 4, 2026 released deepsec, an open-source tool that scans an entire codebase with an AI agent to detect vulnerabilities. It is designed to run on the user's own infrastructure and can be launched with a single command (Vercel blog). The repository is published on GitHub under the Apache 2 license.

May 4, 2026 · Vercel Labs

deepsec: an open-source AI agent that hunts hidden vulnerabilities in your codebase

An "agentic SAST" scanner that runs on your own infrastructure with a single command — pairing a fast static pass with AI agents that track data flows, check mitigations and rate severity where pattern-matching tools fall short.

~15s

Static scan of ~2,000 files — no AI calls

~110

Regex matchers narrow down candidate files

1,000+

Concurrent runs in parallel on Vercel Sandbox

10–20%

False-positive rate, cut by revalidation

The five-stage pipeline

One static pass, then AI agents take over — owner identified from git metadata.

1 · Scan

No AI · ~110 regex matchers

→

2 · Investigate

Agent tracks data flow

→

3 · Revalidate

Cuts false positives

→

4 · Enrich

Severity + owner

→

5 · Export

Actionable report

What it runs on

Default models at max effort — on Vercel AI Gateway or your own API keys. Open source under MIT / Apache 2.

Default model

Claude Opus 4.7

Max effort

Default model

GPT-5.5

xhigh reasoning

Where it shines

Surfaces issues a security engineer should actually flag
High detection counts with a strong true-positive rate
Caught subtle edge cases in auth paths internally
Runs on infrastructure under your own control

The caveats

Cost can hit thousands to tens of thousands of $ on large repos
Business-logic flaws, RBAC edges & async races still slip through
Pair with runtime penetration testing
Better suited to apps than libraries or frameworks

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.