New Agent Plugin Automates Critical Security Patches
The open-source tool scans infrastructure and generates verified pull requests to fix PHP, Node.js, and GitLab vulnerabilities.
Updated on Oct. 25, 2026 in Software
Live Poll
Do you trust automated tools to handle critical security patching in your software systems?
Cognition has released an open-source agent plugin designed to automate the remediation of specific software vulnerabilities. The tool, which is available now, supports automated patching for PHP2Shell, Node.js security issues, and a critical GitLab bug.
Why it matters
By automating the identification and patching of critical remote code execution vulnerabilities, this plugin reduces the manual overhead required to secure complex infrastructure. It provides a standardized framework for agents to execute secure, verified code changes across diverse development environments.
The plugin supports three distinct agent skills and requires Node.js version 22.20 or later for non-Devin installations. It generates one pull request per repository, including test results and a rollback plan, after addressing flaws like the 10 vulnerabilities in the October Node.js release.
The players
Cognition
An AI research firm that builds autonomous coding agents designed to execute software engineering tasks from high-level prompts.
The details
The plugin functions by scanning infrastructure components, including Dockerfiles, base images, distribution packages, and configuration management files. Once a vulnerability is identified, the system performs package verification and testing before generating a pull request that includes runtime diffs. For GitLab CVE-2026-110264, the process automates the path to remediation for a vulnerability that otherwise necessitates manual intervention at the administrative level.
Timeline
October 21, 2026: Node.js security release issued.
October 25, 2026: Cognition releases the open-source agent plugin.
The Tech Race
This release marks an shift in the AI agent race toward active infrastructure defense rather than just code generation. It aligns with broader industry efforts to automate the software supply chain lifecycle following the security flaws identified in the October 2026 Node.js release.
Developers using coding agents can now integrate automated patching workflows by utilizing the plugin in environments that support SKILL.md files. Users must ensure their systems are updated to Node.js 22.20 or later to install the tool outside of the Devin ecosystem.
The takeaway
This plugin standardizes the path from vulnerability discovery to code submission for high-criticality flaws. Security teams should monitor the efficacy of these automated pull requests compared to manual patches over the next quarter.
Further reading
For broader trends in automated security, explore the latest developments in our Software section.
More information
View the complete plugin source code repository for installation guides.
Live Poll
Do you trust automated tools to handle critical security patching in your software systems?
