Form3 split its production patching agent to keep GitHub writes and CI out of the model layer
AI Engineer · youtube · 2026-07-21
This Form3 talk argues that once an AI agent can touch repositories, CI logs, credentials, and Docker sockets, it becomes part of the software supply chain whether you planned it or not.
- A single PatchPilot PR changed about 70,000 lines across repositories, which exposed the core issue: the danger is not just what the agent edits, but what it can reach.
- Form3 split the system into two layers: a deterministic Go layer keeps dangerous powers such as GitHub writes and CI triggers, while the agent layer only edits files on disk.
- To reduce the blast radius from prompt injection and container escape risk, the team moved execution into a Firecracker microVM with its own kernel and per-layer network policy.
- The broader message is that agent security is an architecture problem, not just a prompt problem.
More from coding & agent
- Shopify design lead on AI-era workflow: designers are becoming full-stack editors — KlausCodes · 2026-10-26
- Ultrametric open-sources Open Startup Repo to let AI agents run startup operations — garrytan · 2026-10-26
- MCP fault injection study: agent task scores drop 60% under realistic tool failures, scale doesn't help — dair_ai · 2026-10-26
- General agents burn ~140M tokens/month on LinkedIn outreach; scripts do it 60x cheaper — ChrisHarpon2 · 2026-10-26
- OpenAI upgrades Decisions API: 400 questions per call, native voice and image support — OpenAIDevs · 2026-10-26
- NLI alone rejects 5/6 new agent memories; a 0.45 similarity gate fixes it all — Alternative_Pin9598 · 2026-10-26