His Majesty's Courts and Tribunals Service (HMCTS) worked with CGI to explore how agentic AI could automate vulnerability remediation. Using OpenAI Codex, the team built and deployed a controlled, auditable workflow in five days, reducing vulnerability remediation effort from hours to minutes while maintaining developer oversight and code quality.

The challenge: Balancing delivery priorities and CVE remediation

His Majesty’s Courts and Tribunals Service (HMCTS) support the delivery of criminal, family and civil proceedings across England and Wales, and tribunals across England, Wales and Scotland.

Operating at scale, HMCTS manages around 4.2 million cases annually, supported by 15,000 staff, over 50 digital products and approximately 1,700 code repositories. Within this environment, development teams balance feature delivery, service improvement and ongoing maintenance.

A key pressure point was managing Common Vulnerabilities and Exposures (CVEs). While detection was already embedded in development pipelines, remediation required significant developer time. With an estimated average of five hours per CVE across thousands of repositories, this created a material demand on engineering capacity. HMCTS wanted to explore whether AI could reduce this burden, without compromising control, quality or security.

The solution: Agentic AI for CVE remediation

HMCTS and CGI set out to explore whether agentic AI could be used to remediate CVEs and free up developer time while maintaining control, quality, security and auditability. The team adopted a specification-driven approach with a five-day delivery target, using AI both to build the application and to operate within it. OpenAI Codex served as the coding agent throughout, supporting both development and in-application remediation.

To ensure predictable and repeatable behavior, a structured set of artifacts was introduced to guide how the agent operated. This established a workflow where requirements and guardrails were defined upfront, and the agent generated and executed plans to produce code.

An AGENTS.md file defined coding standards, architectural principles and technology stack, including the use of a standardized HMCTS Express.js template. Execution was structured through a plans file, breaking work into defined stages covering purpose, system context, implementation steps and decision logs. These served as living documents, maintaining context throughout.

Reusable ‘skills’ encoded specific workflows, including accessibility, CVE remediation, validation of CVE identifiers against external APIs, and implementation aligned to the GOV.UK Design System. This ensured outputs followed consistent patterns, including the use of GOV.UK Nunjucks templates and accessibility standards.

The solution integrated with existing HMCTS pipelines. CVEs identified through Jenkins were written to a central database and surfaced through a dashboard, providing visibility of vulnerabilities across repositories. From this interface, a remediation workflow could be triggered. Repository code and CVE data were sent to Codex via the OpenAI API Platform which generated a structured remediation plan. This included a summary of the vulnerability, affected components, recommended upgrade path, detailed findings and a step-by-step implementation checklist. It also highlighted verification steps and risk mitigation guidance.

Each plan was reviewed by a member of the team before execution, with the option to approve, regenerate or decline. Once approved, the agent applied the required changes to create a pull request. All changes were then reviewed and merged through standard engineering processes, ensuring automation of remediation while maintaining control and oversight.

Benefits and outcomes: Faster remediation with control maintained

In five days, HMCTS and CGI moved from concept to working solution that demonstrated how agentic AI could be applied to CVE remediation in a controlled development environment. By combining strategic preparation, defined guardrails and reusable workflows, the approach automated manual effort while maintaining governance, auditability and alignment with existing engineering practices:

  • Reduced development time – delivered a working solution in five days versus an estimated four weeks
  • Accelerated remediation – reduced CVE resolution effort from hours to minutes
  • Maintained engineering oversight – ensured all plans and code changes were reviewed before approval and merge
  • Sustained governance and auditability – aligned outputs with existing standards and controlled workflows
  • Enabled organizational learning – supported exploration of skills, governance and responsible AI use
Delivered in five days
 
Working with CGI, HMCTS moved from concept to a working agentic AI solution in five days, compared with an estimated four weeks to build it manually
 
Reduced remediation effort
 
Agentic AI reduced CVE remediation effort from hours to minutes, while engineers retained control through review and approval of plans and code changes
 
By experimenting with agentic AI in a controlled way, we were able to reduce the time spent on CVE remediation from hours to minutes, while keeping the engineers firmly in control of the process. It has helped us better understand both the potential and the limitations of the technology.

Steve Newman Principal Software Developer, HMCTS

Better positioned to scale responsible AI

HMCTS gained practical experience applying agentic AI within controlled engineering processes. The work demonstrated how automation can reduce remediation effort while retaining developer oversight, governance and auditability. It also helped HMCTS build its understanding of the skills, controls and responsible AI practices needed for future use.

To find out more:

Explore our work across public safety and justice