AWS Continuum for code vulnerabilities is now generally available

What happened

On 22 October 2026 Amazon Web Services announced general availability of AWS Continuum for code vulnerabilities, a security service that finds and validates code vulnerabilities and delivers fixes as patches or as pull requests in a customer's repositories ^[1]. It confirms which findings are exploitable in the customer's environment, ranks the resulting issues by business impact and proposes a fix for each ^[1].

The problem it targets

AWS argues that threat actors using frontier AI models can turn a vulnerability disclosure into working exploit code in minutes, while the same tools speed up development and raise the volume of findings teams must process ^[1]. Large organisations may see thousands of scanner findings a day, many needing no action because they are unreachable, unexploitable or already mitigated ^[1]. Confirming exploitability previously took hours of manual investigation, and shipping a fix with confidence took days of coordination across teams, AWS says ^[1].

How it works

Continuum builds a context graph from two sources: the customer's code repositories and their AWS environment. For the latter, a collector gathers details such as AWS Config resources and network configuration to judge whether a flaw is reachable over the network ^[1]. It uses this to identify high-value systems such as customer data stores, payment pipelines and authentication services, and ranks issues by how close the attack path runs to them ^[1].

For findings it can reproduce, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps, alongside the attack path and a blast-radius assessment ^[1]. For each confirmed issue it generates a fix, which may be a code patch, a dependency upgrade or a configuration change, and opens it as a pull request ^[1].

People stay in charge

Every remediation starts in a mode where Continuum proposes the fix and a person approves it before it ships ^[1]. AWS says that in future customers will be able to decide which actions Continuum can take on its own, within guardrails they define, such as test coverage, scope bounds and historical success rate ^[1]. The console is explicit that a generated patch does not mean the issue is fixed until it is reviewed and merged ^[1].

In the walkthrough, the author connects a code source, either GitHub or an Amazon S3 bucket, and creates an environment that scans on a chosen schedule. One example issue was rated High severity, with a fix delivered to GitHub that changed four files, adding 50 lines and removing 24 ^[1].

Availability and what it means

The service is available today in the US East (N. Virginia) and US West (Oregon) Regions, with pricing on the AWS pricing page ^[1].

For non-technical leaders, the idea is worth understanding even if you never log in to it: instead of handing developers a long list of warnings, the tool tries to prove which ones matter and prepares the repair. That could shorten the time between a flaw being found and fixed. The caveats are that the claims come from AWS itself, it only works for teams on GitHub or S3 code sources today, and a human still has to review each change ^[1]. Companies should test it on a small environment and judge the quality of its fixes before relying on it.

Source: Amazon Web Services — AWS Continuum for code vulnerabilities is now generally available