Muhammadu Lebbe Hibathul Careem

Security scanners are good at identifying misconfigurations, but they don't fix them. Most AI-powered remediation tools go a step further by suggesting fixes, but they often rely on another scan to confirm success. That doesn't necessarily prove the vulnerability is actually gone or that the application still works. **ProveFix takes a different approach.** It's an AI-powered security remediation agent that doesn't just fix vulnerabilities — it proves the fix works. For every finding, ProveFix first attempts to reproduce the actual attack to confirm the vulnerability is exploitable. It then uses Meta's Muse Spark model to generate a fix and validates the result through three independent checks: the attack must fail, the application must remain healthy, and an independent Kubescape scan must pass. It also catches fake or unsafe fixes, such as deleting workloads or breaking application selectors. If a fix fails validation, it retries up to three times before escalating to a human for review. Everything runs in an isolated namespace on a local kind and Calico Kubernetes cluster, keeping production environments completely untouched. **Built with:** Python, Meta Muse Spark via the Meta Model API, Kubernetes (kind), Calico and Kubescape. **End-to-end demonstration:** Successfully tested against two real-world Kubernetes security scenarios: - **C-0260:** Exposed database due to a missing NetworkPolicy. - **C-0057:** Privileged container with potential host-level access. Both vulnerabilities were successfully remediated and independently verified against the live model, with the attack blocked, application healthy, and security scan clean.