StackHawk Wingman: An AI to Police Your AI Coder

StackHawk's Wingman has a clever premise: it finds security flaws and makes the AI agent that wrote the code fix its own mess. The idea is to create an automated feedback loop for AI-generated code. In practice, its success is completely dependent on the AI agent’s ability to understand a vulnerability report and patch it correctly, which is a major, unproven assumption.

How does Wingman work?

StackHawk has introduced Wingman, a tool designed to automatically find and fix security flaws in code produced by agents like GitHub Copilot. Unlike a standard DAST scanner that just generates a report for a human, Wingman takes its findings and pipes them back to the original AI agent. The proposed workflow is: AI agent completes a task, Wingman probes the live application for vulnerabilities, and then it sends a patch request back to the AI agent that supposedly holds the original context.

What’s the main point of failure?

The weak link in Wingman's chain is the AI agent itself. The system assumes the agent—be it GitHub Copilot or something based on Claude Code—can receive a DAST report, understand the vulnerability, and generate a correct, non-breaking patch. This is a huge leap. An AI agent today might "fix" a SQL injection by clumsily escaping all user input, breaking functionality in the process. The context that Wingman claims the AI retains is often lost once the initial code generation is done, making the feedback loop feel more like handing a bug report to a developer with short-term memory loss.

So, should you use it?

I wouldn't let Wingman auto-commit patches without human review. The concept of feeding DAST results back to the source agent is a good one, but the state of AI code generation isn't mature enough for a closed-loop system. Use Wingman as a highly-contextualized security linter that points out issues for a human developer to address, using the AI's suggested patch as a starting point. It’s a tool for supervised automation, not a fully autonomous security guard for your codebase.

FAQ

Does Wingman replace SAST scanners? No. Wingman is a dynamic application security testing (DAST) tool that runs against a live application. It complements static application security testing (SAST) tools, which analyze your source code without executing it. You still need both.

Which AI coding agents does Wingman support? The initial announcement mentions GitHub Copilot and Claude Code. The architecture seems designed to be extensible to other AI agents that expose an API for code modification tasks.

Can Wingman only scan AI-generated code? It can scan any running application, regardless of how the code was written. The unique feature is its ability to route the findings back to an AI agent for patching, which is most effective when that same agent wrote the original code.