Atlassian: AI Agents Fixed Over 120 Security Vulnerabilities in Bitbucket in Three Months

On August 30, Atlassian published an account of the first large-scale deployment of its Agentic Pipelines feature in Bitbucket Cloud, in which AI agents autonomously search for vulnerable repositories, patch security flaws, and prepare pull requests ready to merge, rather than leaving developers with yet another ticket in the queue.

Three roles in the automation chain

The process Atlassian describes splits the work into three components. The first, called the Dispatcher, scans Jira tickets for vulnerabilities, assesses which ones are suitable for automated fixes, and groups related work together so the agent doesn't open a separate pull request for every small fix in the same file.

The second component, the Coding Agent, does the actual engineering work: it updates the repository, runs existing tests, creates a branch, and opens a pull request. The agent follows instructions stored directly in the repository, so teams can define their own code style rules, required tests, or how changes should be described, instead of relying on the model's default behavior.

The third component, the Closer, steps in after changes are merged: it verifies the deployment went smoothly and updates the ticket status in Jira. A human stays in the loop at the code review stage, since the agent has no authority to merge changes into the main branch on its own.

Results after three months

Atlassian cites concrete numbers from its own deployment. One engineering team closed more than 120 vulnerabilities over three months, and agents created more than 55 pull requests that ultimately landed in the main code branch. The most telling figure is the quality rate: 95 percent of those pull requests were accepted with no revisions and no test failures on the first try.

That rate means reviewers, in most cases, are simply confirming a finished change rather than negotiating further iterations with the agent. For security teams that typically face a growing backlog of CVE reports and scanner-flagged vulnerabilities, that translates directly into engineering time saved, not just tickets closed.

Start your day with a tested pull request, not another ticket to pick up - Arthy Vijayaraghavan, Senior Engineering Manager, Atlassian

Who can use it

Agentic Pipelines remains in open beta and requires a paid Bitbucket Cloud account with Pipelines enabled, plus a separate Rovo Dev Standard subscription. The feature supports a choice of three agent engines: Atlassian's own Rovo Dev, Anthropic's Claude Code, and OpenAI Codex, letting teams stick with their existing model provider preferences.

Agentic Pipelines itself was originally announced more broadly than just as a security tool, as a way to automate tedious, repetitive tasks such as fixing flaky tests, generating release notes, or diagnosing failed builds. The August 30 post narrows that narrative to a single, concrete, and measurable use case: removing vulnerabilities from production code.

What it means for developers

Atlassian's example fits a broader trend of shifting coding agents from suggesting lines of code in an editor to executing entire tasks tied to a ticketing system. Instead of a developer clicking to accept a suggestion in an IDE, in this model the agent moves on its own from a Jira ticket to a finished, tested pull request.

For security teams and companies managing large repositories, that could mean faster response times to vulnerabilities without adding headcount. A key caveat remains: the process still requires human review before code is merged, and the 95 percent figure applies to one internal Atlassian team, so other organizations may see different results depending on the quality of their own instructions and test coverage.