Vercel agent patched 14,665 vulnerabilities in a week

Guillermo Rauch posted a one week scoreboard for Vercel Security Review. 57,897 vulnerabilities identified, 6,029 of them critical or high, and 14,665 already patched by the agent. He adds that you can turn it on for any repo, no matter where you deploy to.

Guillermo Rauch

@rauchg

X

I'm shocked at ① the number of critical vulnerabilities that would go unnoticed and ② the ease at which the agent automatically fixes them.

The growth curve is the part worth staring at. In the first 24 hours Rauch reported 6,817 vulnerabilities identified, 580 critical or high, and 1,411 patched. So in the days after launch the find count went up roughly nine times and the patch count roughly ten times, which is what you would expect as more repos get switched on rather than as the agent getting better. That first post also noted the reviews were free until Nov 10.

What the numbers do and do not say

These are vendor counts of its own product, published by the company's co-founder, with no false positive rate attached and no breakdown of what a vulnerability is. Static analysis tools have always been able to produce large findings counts. The number that would settle the argument is how many of the 14,665 agent patches survive human review and stay merged, and nobody has published that.

Rauch's own framing is less about the totals than about the two ends of the pipeline. He says he is shocked both at how many critical vulnerabilities would otherwise go unnoticed and at how easily the agent fixes them. Those are two separate claims and the second is the one that costs you if it is wrong, because a wrong security patch is a code change that looks authoritative and ships with a reassuring label on it.

For working engineers the practical read is that the detection half is cheap to try and the remediation half is where your review budget goes. An agent opening patches against your repo is still an agent opening patches against your repo, and a security context does not make the diff more trustworthy. If you turn it on, treat the 6,029 critical and high findings as a triage queue rather than a to do list that something else already completed.