StackHawk Launches Wingman to Patch Security Flaws Inside AI Coding Sessions

Wingman installs into agentic coding workflows including Claude Code, Cursor and GitHub Copilot, and also supports Codex and Antigravity. It fires when a coding agent marks a feature as done. The scanner configures itself, boots the running application and probes it the way an attacker would, with no manual setup step. Findings are then returned to the agent that wrote the code, which patches the flaw, and a second scan checks the repair before a pull request opens.

StackHawk's argument is that an agent that built an application already holds its architecture, its dependencies and the conventions the rest of the team codes to. The company said that context is what separates Wingman from a scanner bolted on downstream, and that patches come back in the shape of the surrounding code. Wingman also tells the continuous integration pipeline whether a commit is clean. Because every test carries the commit it ran against, security teams end up with a record of what shipped.

StackHawk said Wingman fixed more than 7,000 vulnerabilities for early-access customers before the launch, and that 98% of those repairs have held.

Attackers often reach a vulnerability before it is publicly disclosed, Chief Executive Joni Klippert said, and AI coding agents have pushed engineering teams out ahead of what security can absorb. "Finding was never the hard part," Klippert said. "Fixing and verifying [a vulnerability] fast enough to match how engineering teams ship today, at machine speed, inside the workflow, as the code is written, is what security teams have never had the staff or the hours to do."

Wingman costs $10 per user each month and includes unlimited applications with 50 scans per user a month. A 14-day free trial is available. Teams that need broader application programming interface discovery and attack-surface mapping can pair the tool with StackHawk Scale, the company's enterprise tier.

StackHawk sells to more than 200 enterprises. The company is venture capital-backed and raised $20.7 million in May 2022 in a round led by Sapphire Ventures and Costanoa Ventures. Klippert spoke with theCUBE, SiliconANGLE Media's livestreaming studio, in March, when she said developers should not have to become security specialists to ship safe code. "They want to write quality code, but they don't want to become security engineers," she said.