Collaborative Intelligence in DevSecOps: A Multi-Agent Framework for Autonomous Vulnerability Detection and Remediation

The adoption of Continuous Integration and Continuous Delivery (CI/CD) practices has accelerated software delivery but has also introduced substantial security challenges. Conventional DevSecOps approaches rely on isolated security scanning tools with high false-positive rates, and identified vulnerabilities are typically fixed manually, which delays deployments. This research aims to design and evaluate an agentic AI-powered DevSecOps framework that uses a multi-agent system to automate security tasks in the Software Development Life Cycle (SDLC). The framework deploys eight specialized artificial intelligence agents, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA) and remediation agents, coordinated through an event-driven message bus built with the Google Agent Development Kit (ADK) and the Gemini Large Language Model (LLM). On 228 labelled code units from WebGoat, DVWA and OWASP Juice Shop, the framework's LLM-assisted SAST agent achieved a macro-average Defect Detection Rate (DDR) of 90.36% (pooled 91.38%), compared with 27.13% for the Semgrep scanner alone (exact McNemar test, p < 0.001), at the cost of a higher false-positive rate (46.30% against 9.26%). Flaky-test classification reached an F1 score of 1.0 in a controlled simulation. Across 90 remediation cases, the Mean Time to Remediate (MTTR) from vulnerability analysis to pull-request preparation was 7.19 seconds, compared with typical manual remediation times of 2 to 4 hours. These results suggest that distributing tasks among specialized AI agents can mitigate the context-window limitations of single-agent LLM assistants. We conclude that multi-agent AI systems are a promising approach to addressing the limitations of existing security tools and single-agent assistants, provided that their false positives are controlled. This research contributes to software engineering practice and knowledge by providing an autonomous detection and remediation framework that reduces the trade-off between deployment speed and software security, and by identifying the further validation required before production use.