His Majesty's Courts and Tribunals Service (HMCTS) worked with CGI to explore how agentic AI could automate vulnerability remediation. Using OpenAI Codex, the team built and deployed a controlled, auditable workflow in five days, reducing vulnerability remediation effort from hours to minutes while maintaining developer oversight and code quality.
The challenge: Balancing delivery priorities and CVE remediation
His Majesty’s Courts and Tribunals Service (HMCTS) support the delivery of criminal, family and civil proceedings across England and Wales, and tribunals across England, Wales and Scotland.
Operating at scale, HMCTS manages around 4.2 million cases annually, supported by 15,000 staff, over 50 digital products and approximately 1,700 code repositories. Within this environment, development teams balance feature delivery, service improvement and ongoing maintenance.
A key pressure point was managing Common Vulnerabilities and Exposures (CVEs). While detection was already embedded in development pipelines, remediation required significant developer time. With an estimated average of five hours per CVE across thousands of repositories, this created a material demand on engineering capacity. HMCTS wanted to explore whether AI could reduce this burden, without compromising control, quality or security.
The solution: Agentic AI for CVE remediation
HMCTS and CGI set out to explore whether agentic AI could be used to fix CVEs and free up developer time without losing control, while maintaining quality, security and auditability. The team adopted a specification-driven approach with an ambitious five-day delivery target, using AI both to build the application and to operate within it. OpenAI Codex served as the coding agent throughout, supporting both development and in-application remediation.
To ensure predictable and repeatable behaviour, a structured set of artefacts was introduced to guide how the agent operated. This established a workflow where requirements and guardrails were defined upfront, and the agent generated and executed plans to produce code.
An AGENTS.md file defined coding standards, architectural principles and technology stack, including the use of a standardised HMCTS Express.js template. Execution was structured through a plans file, breaking work into defined stages covering purpose, system context, implementation steps and decision logs. These acted as living documents, maintaining context throughout.
Reusable ‘skills’ encoded specific workflows, including accessibility, CVE remediation, validation of CVE identifiers against external APIs, and implementation aligned to the GOV.UK Design System. This ensured outputs followed consistent patterns, including the use of GOV.UK Nunjucks templates and accessibility standards.
The solution integrated with existing HMCTS pipelines. CVEs identified through Jenkins were written to a central database and surfaced through a dashboard, providing visibility of vulnerabilities across repositories. From this interface, a remediation workflow could be triggered. Repository code and CVE data were sent to Codex via the OpenAI API Platform which generated a structured remediation plan. This included a summary of the vulnerability, affected components, recommended upgrade path, detailed findings, and a step-by-step implementation checklist. Verification steps and risk mitigation guidance were also highlighted.
Each plan was reviewed by a member of the team before execution, with the option to approve, regenerate or decline. Once approved, the agent applied the required changes to create a pull request. All changes were then reviewed and merged through standard engineering processes, ensuring automation of remediation while maintaining control and oversight.
Benefits and outcomes: Faster remediation with control maintained
In five days, HMCTS and CGI moved from concept to working solution that demonstrated how agentic AI could be applied to CVE remediation in a controlled development environment. By combining strategic preparation, defined guardrails and reusable workflows, the approach automated manual effort while maintaining governance, auditability and alignment with existing engineering practices:
- Reduced development time – delivered a working solution in five days versus an estimated four weeks
- Accelerated remediation activity – reduced CVE resolution effort from hours to minutes
- Maintained engineering oversight – ensured all plans and code changes were reviewed before approval and merge
- Sustained governance and auditability – aligned outputs with existing standards and controlled workflows
- Enabled organisational learning – supported exploration of skills, governance and responsible AI use
Delivered in five days
Reduced remediation effort
By experimenting with agentic AI in a controlled way, we were able to reduce the time spent on CVE remediation from hours to minutes, while keeping the engineers firmly in control of the process. It has helped us better understand both the potential and the limitations of the technology.
Principal Software Developer, HMCTS
Better positioned to scale responsible AI
HMCTS now has practical experience of applying agentic AI within controlled engineering processes. The work demonstrated how automation can reduce remediation effort while retaining developer oversight, governance and auditability. It also helped HMCTS build its understanding of the skills, controls and responsible AI practices needed for future use.
To find out more:
