Ortelius Blog
Topics include Supply Chain Security, Vulnerability Management, Neat Tricks, and Contributor insights.
Ortelius Takes Second Place at AllDayAI Hackathon
Ortelius wins second place at the AllDayAI Hackathon with the CVE Reasoner Engine, demonstrating AI-powered dependency upgrades and validated vulnerability remediation.
Categories:
Ortelius Takes Second Place at AllDayAI Hackathon with AI-Powered CVE Remediation Engine
Open-source innovation demonstrates how AI can help developers move beyond vulnerability detection to automated, validated remediation.
The Ortelius open-source community has another reason to celebrate! The Ortelius team earned second place at the AllDayAI Hackathon, showcasing an innovative approach to one of software security’s most persistent challenges: fixing vulnerable dependencies without breaking applications.
With the strong guidance from Utkarsh Sharma, they developed and tested the CVE Reasoner Engine, an AI-assisted remediation solution, using MCP, designed to automate dependency upgrades, validate changes through real application builds and tests, and intelligently escalate complex remediation work to developers.
Special congratulations go to Utkarsh Sharma and Jing Chen, whose significant technical contributions and dedication were instrumental in bringing the project to life.
The hackathon team also included Steve Taylor-platform support, Tracy Ragan-project management and presentations, and Gordon Uszkay-messaging, demonstrating the power of open-source collaboration and a shared commitment to improving software supply chain security.
The Challenge: Finding Vulnerabilities Is Only Half the Battle
Software development teams have access to an expanding ecosystem of vulnerability scanners, software composition analysis (SCA) tools, and software bills of materials (SBOMs). These technologies help identify vulnerable open-source dependencies, but detection alone does not eliminate risk.
Once a vulnerability is discovered, developers must still answer several difficult questions:
- Which version of the dependency fixes the vulnerability?
- Will upgrading the package break other dependencies or application functionality?
- What code changes are required to maintain compatibility?
- How can the team verify that the vulnerability has actually been resolved?
- What happens when there is no safe or compatible upgrade?
These questions often turn what appears to be a simple dependency update into hours or days of investigation, testing, and development work.
For organizations maintaining hundreds of applications and thousands of dependencies, the result is a growing backlog of unresolved vulnerabilities.
The Ortelius team approached the hackathon with a straightforward goal: Can we use AI to automate the difficult parts of vulnerability remediation while retaining the safeguards needed to protect application stability?
Introducing the CVE Reasoner Engine
The CVE Reasoner Engine moves beyond reporting vulnerabilities to taking actionable steps toward resolving them.
The solution combines automated dependency management, vulnerability intelligence, AI-assisted reasoning, and deterministic validation within a governed remediation workflow. When Ortelius discivers a newly reorted CVE, the engine identifies outdated and vulnerable dependencies, retrieves recommended safe versions, performs reachability analysis, and attempts to upgrade the affected packages.
Rather than assuming an upgrade is successful because a dependency file has changed, the engine executes the application’s own build and tests inside an isolated sandbox. If the upgrade succeeds, the engine performs another vulnerability scan and prepares a GitHub pull request documenting the changes and results.
If the upgrade breaks the application, AI analyzes the failure to determine whether it can be corrected through a small, controlled code modification or requires a more extensive migration. Small fixes can be proposed for human review, applied, and retested. Changes that cannot be safely validated are rolled back. When remediation cannot be completed automatically, the engine creates a GitHub issue documenting the remaining work.
The result is a remediation process that fixes what it can, validates what it changes, and never silently ignores what remains unresolved.
What Makes This Approach Different?
The innovation behind the CVE Reasoner Engine is not simply the use of AI to generate code. It is the combination of AI reasoning with deterministic controls, repeatable validation, and human oversight.
1. Safe Versions Based on Vulnerability Intelligence
Ortelius provides information about vulnerabilities associated with deployed software releases and identifies appropriate safe dependency versions.
This allows the remediation process to prioritize security-driven upgrades rather than blindly updating every dependency to its latest release.
2. AI-Assisted Compatibility Resolution
Dependency upgrades frequently introduce breaking changes that require modifications to application source code. The CVE Reasoner Engine uses AI to analyze build failures, identify potential compatibility issues, and determine whether a bounded correction is practical.
The prototype constrains AI-generated fixes to a maximum of three files and 40 lines of code. More complex changes are treated as migration work requiring developer attention.
3. Validation Before Success Is Claimed
Every attempted upgrade is validated through the repository’s own build and test process. The engine also performs before-and-after vulnerability scans to determine which vulnerabilities were addressed.
If an AI-generated correction fails validation, the change is reverted. This is an important distinction: AI may recommend a fix, but successful validation determines whether the fix is retained.
4. Human Oversight Remains Essential
The engine does not autonomously merge code into an application’s default branch. Developers retain control over code approval and merges. By default, AI-generated source-code changes are presented for review before being applied. This ensures that AI assists developers without bypassing established software development and security governance practices.
5. Unresolved Vulnerabilities Become Actionable Work
Not every vulnerability can be resolved through an automated package upgrade. Some packages have no fixed release. Others require extensive application changes.
Instead of treating these situations as successful remediation, the engine creates developer stories documenting migration requirements, remaining vulnerabilities, or possible alternatives. This helps teams turn vulnerability findings into actionable engineering work.
Demonstrating Three Real-World Remediation Scenarios
The hackathon project was designed around three important outcomes that developers routinely encounter.
| Scenario | CVE Reasoner Engine Response |
|---|---|
| Safe dependency upgrade | Updates the dependency, executes builds and tests, verifies the result, and creates a pull request. |
| Breaking dependency upgrade | Uses AI to assess compatibility failures and propose bounded fixes. If safe remediation is not possible, rolls back the upgrade and creates a migration story. |
| Ambiguous or unfixable vulnerability | Avoids claiming an unsupported fix and creates a security issue when no fixed release is available. |
These scenarios illustrate a central principle of responsible AI-assisted remediation: successful automation includes knowing when not to make a change.
Watch the Demo:
Building Responsible AI into DevSecOps
As AI-assisted software development becomes more common, organizations must consider how to introduce automation without weakening security controls or increasing operational risk. The CVE Reasoner Engine addresses this concern through a governed architecture built around a checkpointed LangGraph workflow, isolated execution environments, defined AI decision boundaries, and auditable outcomes.
Each remediation run captures information about the dependency changes, validation results, AI recommendations, human decisions, and final GitHub artifacts. The prototype also identifies areas for additional production hardening, including stronger application-level API authentication, tighter control over which workspace files can enter pull requests, and improved credential isolation.
These considerations are important because responsible AI is not just about what a model can do. It is about controlling what it is allowed to do and verifying the outcome.
What’s Next for Ortelius and AI-Powered Remediation?
The hackathon demonstrated an important direction for the future of software supply chain security.
Vulnerability management must evolve beyond generating alerts and reports. Development and security teams need technologies that help them determine what is vulnerable, identify safe fixes, validate remediation, and manage the work that cannot be automated.
Ortelius provides the open-source foundation for understanding software components, deployed dependencies, and vulnerability exposure. The CVE Reasoner Engine explores how that intelligence can be combined with AI-assisted automation to reduce the effort required to remediate vulnerabilities.
The next challenge is to build on the prototype, strengthen its security controls, expand testing across different dependency ecosystems, and explore how these capabilities can evolve through open-source collaboration.
Second place at the AllDayAI Hackathon is an exciting milestone, but the bigger opportunity lies ahead.
The future of software security isn’t just about finding vulnerabilities faster. It’s about fixing them safely, proving the results, and knowing when human expertise is required.
Join the Ortelius Community
Interested in AI-assisted vulnerability remediation, software supply chain security, or contributing to open-source DevSecOps innovation?
Explore the Ortelius project, join the community, and help us build the next generation of software security automation.
Explore Ortelius | Contribute on GitHub