A dependency update can pass every test yet remain unsafe—this system catches it.

Updating cryptography code can cause hidden problems. An update might install cleanly and pass standard tests, yet secretly break how an app works or keep it vulnerable. Researchers created VeriCrypt-Agent to check these updates safely. The system looks at release notes, security advisories, and test scripts called probes. It runs the software with both the old and new dependency versions to see if behavior changes. Specialized AI agents reason over the results, and a strict rule engine makes the final choice. It only auto-merges an update if all mandatory checks pass, rules are met, and records are complete. In tests on thirty runs, standard tests mistakenly accepted all five dangerous updates, and checking advisories alone accepted two of five. The full system allowed zero unsafe auto-merges, routing nine runs to human review instead. It safely blocks bad updates that normal testing misses.

Why it matters

When a cryptographic library update installs cleanly and passes tests, developers assume it's safe. This system proves that assumption can be wrong and catches the hidden breakage or vulnerability automatically. It matters for anyone shipping software that depends on crypto: an unsafe update can silently change behavior or leave an app inside a known vulnerable range.

Questions answered