Shopify's AI Agent River Clears 70% of Vulnerability Backlog in 11 Days

Shopify's infrastructure security team brought in River, an internal AI coding agent, for autonomous vulnerability remediation. The first batch of results on dependency vulnerabilities: in 11 days, the open vulnerability backlog dropped by about 70%, and the patch merge rate rose from 10% to 80%. According to author jevon, River's value isn't writing more patches—it's getting patches merged and vulnerabilities actually eliminated, something security and engineering teams should take note of.

Confirmed

River is one of Shopify's internal AI agents; Shopify says it has built the most widely used internal coding agent in the world. The infrastructure security team recently applied it to automated vulnerability remediation with notable results.
First 11-day results: the open vulnerability backlog fell roughly 70%; about 2/3 of that came from merged fix patches, and the rest were closed after River confirmed they were outdated or no longer applicable
Core workflow: River runs at the root of Shopify's monorepo World, reusing the same development environment and written skills as human engineers, driven via Slack
One key method: before taking on any "unfixed" vulnerability, verify it still exists. It turned out about 1/3 of the "open" backlog had already been fixed or no longer applied—River closed those items with evidence rather than writing patches

Why it matters

jevon points out that writing patches is the easy part; the hard part is that the codebase keeps changing while patches pile up awaiting review and vulnerabilities stay alive. River's insight is to focus on verification and merging, not patch volume
The "verify the vulnerability still exists before acting" approach can dramatically cut wasted effort and offers a useful reference for other teams clearing vulnerability backlogs

2026-09-04 ~ 2026-09-04 · 5 related posts

Primary sources

Shopify's River agent cut its vuln backlog 70% in 11 days — jevon · 2026-09-04 03:01 (UTC+08:00)
Shopify's River AI agent cleared 70% of its vuln backlog in 11 days — jevon · 2026-09-04 03:01 (UTC+08:00)
A third of "open" vulns are already fixed: validate before patching — jevon · 2026-09-04 03:01 (UTC+08:00)

Shopify built one of the world's most-used internal coding agents — jevon · 2026-09-04
[source] Shopify's River agent cut its vuln backlog 70% in 11 days — jevon · 2026-09-04
AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80% — jevon · 2026-09-04
[source] A third of "open" vulns are already fixed: validate before patching — jevon · 2026-09-04

1 near-duplicate retellings: jevon