Vercel Labs has released Deepsec, an agent-powered vulnerability scanner designed to surface hard-to-find security issues lurking in enterprise codebases. Unlike traditional static analysis tools, Deepsec leverages coding agents with access to full repository context, enabling it to identify complex vulnerabilities that rule-based scanners miss.
How Deepsec Works
The tool operates in a multi-stage pipeline:
- Scan — Uses regex matchers to quickly identify candidate vulnerability sites
- Process — AI agents investigate each candidate, analyzing code context and relationships to determine if it’s a genuine vulnerability
- Triage — Classifies findings by severity (P0/P1/P2) using smaller, faster models
- Revalidate — Re-checks existing findings and verifies whether they’ve been fixed
Deepsec is designed to run on large-scale repositories, with work fanning out across worker machines in parallel. If a scan is interrupted, it picks up where it left off—skipping already-analyzed files.
Security Considerations
Running an AI agent with shell access to your codebase raises obvious security questions. Vercel addresses this through Vercel Sandbox microVMs, which isolate the agent environment and prevent exfiltration of API keys. The sandbox approach limits network egress to only the coding agent hosts during the bootstrap phase.
The Bigger Picture
Deepsec represents a shift in how enterprises approach security: instead of relying solely on traditional static analysis or manual code review, organizations can now deploy AI agents to actively hunt for vulnerabilities. Whether the cost-to-benefit ratio makes sense for typical projects remains to be seen—but for security-critical codebases, the tool may prove invaluable.