Form3 split its production patching agent to keep GitHub writes and CI out of the model layer
AI Engineer · youtube · 2026-07-21
This Form3 talk argues that once an AI agent can touch repositories, CI logs, credentials, and Docker sockets, it becomes part of the software supply chain whether you planned it or not.
- A single PatchPilot PR changed about 70,000 lines across repositories, which exposed the core issue: the danger is not just what the agent edits, but what it can reach.
- Form3 split the system into two layers: a deterministic Go layer keeps dangerous powers such as GitHub writes and CI triggers, while the agent layer only edits files on disk.
- To reduce the blast radius from prompt injection and container escape risk, the team moved execution into a Firecracker microVM with its own kernel and per-layer network policy.
- The broader message is that agent security is an architecture problem, not just a prompt problem.
More from coding & agent
- Soft Clamp cuts tool-call overuse in multi-teacher distillation, from 13.7% to 9.0% — antgroup · 2026-07-21
- Agent harness memory loss and compaction are still a major usability problem — adityaag · 2026-07-21
- SpecJudge runs locally on Ollama to pick the right-sized AI model for your project — jokiruiz · 2026-07-21
- A developer maps out six design rules for CLIs that humans and AI agents can both use — yujiezha · 2026-07-21
- A coding-agent skill that forces ADHD-friendly, answer-first output — ayghri · 2026-07-21
- A set of agent skills for CAD, robotics, and hardware design — earthtojake · 2026-07-21