Vendor-topped benchmarks always deserve a caveat — AWS built the agent, runs the cloud, and picked the stage — but the notable part is scope: the full find-to-fix loop rather than detection alone. If agentic patching holds up outside curated test suites, it shifts security economics toward defenders, which is the direction the industry has been waiting for. Real codebases are far messier than CyberGym-E2E, so the gap between leaderboard and production will be the real story to watch. Shipping as GA on day one rather than a research demo suggests AWS sees this as a product bet, not a press cycle.