Bolt ships an autonomous security agent to every project
Bolt added an agent that scans, patches and hardens apps built on its platform in one click, with audits and remediation excluded from billing.
Bolt has begun shipping an automated security agent into every project built on its app-generation platform, framing it as a standing security engineer rather than an optional scan. The company said the agent runs a deep scan across an entire application, then patches, fixes and hardens what it finds before the app publishes — a three-step flow triggered from a single click.
Bolt said both the audits and the resulting fixes are excluded from billing, on the reasoning that customers should not be metered for keeping their own applications safe. The agent also integrates with third-party security tooling already in use by some teams, including Socket, XBOW and JFrog, positioning itself as an orchestration layer over existing scanners rather than a replacement for them.
The launch responds to a specific, well-documented problem with prompt-generated applications. Independent scanners have repeatedly found the same defect classes recurring across apps produced on vibe-coding platforms — permissive database rules, exposed credentials, missing authorisation checks on server routes — because the model optimises for a working demo and the user typically cannot audit what shipped. Bolt's own framing acknowledges the asymmetry directly: generation got faster for builders and for attackers at the same time.
The harder question is verification. An agent that both writes the vulnerable code and certifies the patch has an obvious conflict, and Bolt has not published pass rates, benchmark results or details of how remediation is validated. The integrations with independent scanners partially address this by keeping a second, non-Bolt opinion in the loop, but the platform has not said whether a failing external verdict blocks publication.
Why it matters
Prompt-to-app platforms have pushed application deployment to users with no security review capability at all, creating a growing population of internet-facing apps that nobody has audited. Making automated remediation default and free — rather than a paid upgrade — is the first structural attempt to close that gap at the platform layer, and if it holds up under external scrutiny it becomes the baseline every competing builder will be measured against.