AutoRemediate AI is an agent designed to automatically fix low-risk code quality and dependency vulnerabilities in Java/Spring Boot projects. It tackles common issues like unused imports, variables, and known vulnerable libraries, which are often overlooked due to their tedious nature. The agent operates with a strong emphasis on safety and verification, never blindly trusting the AI's suggestions. Instead, it employs a multi-step process: the AI proposes minimal patches, deterministic tools verify their safety, and a human ultimately approves them.The workflow begins by cloning the repository, establishing a baseline with tests and scans, and then classifying findings. For each "safe" finding, the AI generates a small, validated patch, which then undergoes rigorous review. Success hinges on a "safety gate" that verifies the build remains green, all tests pass, the target issue is resolved, and no new problems are introduced.Critical safeguards are in place to prevent the AI from causing harm: edits are tiny, strictly confined to specific file types, and dependency upgrades are handled by code, not the LLM. The system fails closed, rejecting unclear or erroneous patches, and only automates safe categories of findings, leaving security issues for human review.To protect against running untrusted code, the agent isolates processes, scrubs environment variables, and treats repository content as untrusted input. The job lifecycle is managed by an explicit state machine, ensuring predictable transitions and preventing issues like blaming the agent for pre-existing failures. The technology stack includes Java 21, Spring Boot, Maven, and utilizes Anthropic's Messages API for the LLM.Key learnings from this project highlight the importance of measurable baselines, strict output constraints for the AI, and leveraging LLMs only for their "thinking" capabilities while keeping critical processes deterministic. The system is designed for rollback, checkpointing, and retrying, and crucially, always keeps a human in the loop for final approval. The project encourages discussion on how others approach safe automation in code-touching AI agents.