Shopify's AI Agent River Cut 70% of Vulnerability Backlog in 11 Days

Shopify's infrastructure security team deployed its internal AI coding agent River to autonomously fix dependency vulnerabilities. In the first 11 days, the unresolved backlog dropped 70% and the patch merge rate rose from 10% to 80%. Per author jevon, River's value lies not in writing more patches but in getting them merged and truly eliminating vulnerabilities.

Confirmed

River is one of Shopify's internal AI agents; the author says Shopify has built one of the most widely used internal coding agents and has kept improving its flexibility.
First 11-day results: unresolved backlog down 70%; about 2/3 closed via directly merged fix patches, the rest closed by River after confirming they were stale or no longer applicable; merge rate 10%→80%.
Workflow: River runs directly at the root of Shopify's monorepo World, reusing the same dev environment, written skills, and engineering conventions as human engineers, driven through Slack, and automatically checks whether a vulnerability still exists in current code.
Key practice: before taking on any "unfixed" vulnerability, verify it still exists. About 1/3 of the "open" backlog had already been fixed or no longer applied; River closes those with evidence rather than writing unneeded patches.

Why it matters

jevon notes writing patches is the easy part; the hard part is that patches pile up awaiting review while the codebase keeps changing and the vulnerability stays alive. River focuses on verification and merging rather than patch volume.
The "verify before fixing" approach can meaningfully cut wasted effort and offers a useful playbook for other teams clearing vulnerability backlogs.

2026-09-04 ~ 2026-09-04 · 6 related posts

Primary sources

AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80% — jevon · 2026-09-04 03:01 (UTC+08:00)
Shopify's River agent cut its vuln backlog 70% in 11 days — jevon · 2026-09-04 03:01 (UTC+08:00)
Shopify's River AI agent cleared 70% of its vuln backlog in 11 days — jevon · 2026-09-04 03:01 (UTC+08:00)

Shopify built one of the world's most-used internal coding agents — jevon · 2026-09-04
[source] Shopify's River agent cut its vuln backlog 70% in 11 days — jevon · 2026-09-04
[source] AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80% — jevon · 2026-09-04
A third of "open" vulns are already fixed: validate before patching — jevon · 2026-09-04
Shopify's AI Slack agent cut its vulnerability backlog by ~70% in 11 days — jevon · 2026-09-04

1 near-duplicate retellings: jevon