ZeroDay AI — Autonomous Vulnerability Patching System

An autonomous AI agent that detects code vulnerabilities, writes secure patches, and opens GitHub Pull Requests instantly without human intervention.

Comment

Inspiration:

Developers waste hundreds of hours manually reviewing security alerts, writing fixes, and verifying builds. We built ZeroDay AI to transform DevSecOps into an autonomous, self-healing system where software vulnerabilities are remediated automatically before attackers can exploit them.

What it does:

ZeroDay AI runs as an autonomous background agent that monitors repositories for security flaws like SQL injections and exposed API keys. Once a flaw is detected, the agent analyzes the code, writes a secure patch, executes unit tests in a containerized sandbox, and opens a verified GitHub Pull Request without human intervention.

How we built it:

1)AI Engine: Powered by Gemini 3.5 via the Google GenAI SDK for deep code reasoning and patch generation.

2)Agent Framework: Built using Google ADK (Agent Development Kit) to manage multi-step reasoning chains and tool execution.

3)Cloud Infrastructure: Deployed on Google Cloud Run for serverless event handling and test execution, with Firestore for audit logs and state management.

Challenges we ran into:

Building the self-healing feedback loop was our toughest challenge. When a generated patch failed sandbox unit tests, we had to feed runtime error stack traces back into Gemini 3.5 to iteratively fix the patch without causing infinite retry loops.

Accomplishments that we're proud of:

We successfully created an end-to-end, hands-off pipeline that goes from receiving a raw vulnerability webhook to running containerized tests and submitting a clean GitHub Pull Request in under 30 seconds.

What we learned:

We mastered building agentic workflows using Google ADK, connecting non-deterministic LLM reasoning with deterministic CI/CD testing environments, and managing serverless background jobs on Google Cloud.

What's next for ZeroDay AI — Autonomous Vulnerability Patching System:

We plan to add local pre-scanning using Gemma models to catch syntax errors client-side, expand language support beyond Python and JavaScript, and introduce multi-repository dependency upgrading.

Note :

Hackathon Timeline & Pre-Existing Work Disclosure:

ZeroDay AI was newly created and built from scratch during the official hackathon submission period. No pre-existing proprietary codebase or pre-built application was used. In accordance with official rules, the project incorporates standard open-source developer libraries, frameworks, and SDKs including Python 3, FastAPI, React, Tailwind CSS, TanStack Router, the official Google GenAI SDK (google-genai), and Google Cloud Firestore SDK.

Built With

Share this project:

Updates

posted an update —

ZeroDay AI was newly created and built from scratch during the official hackathon submission period. No pre-existing proprietary codebase or pre-built application was used. In accordance with official rules, the project incorporates standard open-source developer libraries, frameworks, and SDKs including Python 3, FastAPI, React, Tailwind CSS, TanStack Router, the official Google GenAI SDK (google-genai), and Google Cloud Firestore SDK.

Log in or sign up for Devpost to join the conversation.

Submission history