Form3 split its production patching agent to keep GitHub writes and CI out of the model layer
AI Engineer · youtube · 2026-07-21
This Form3 talk argues that once an AI agent can touch repositories, CI logs, credentials, and Docker sockets, it becomes part of the software supply chain whether you planned it or not.
- A single PatchPilot PR changed about 70,000 lines across repositories, which exposed the core issue: the danger is not just what the agent edits, but what it can reach.
- Form3 split the system into two layers: a deterministic Go layer keeps dangerous powers such as GitHub writes and CI triggers, while the agent layer only edits files on disk.
- To reduce the blast radius from prompt injection and container escape risk, the team moved execution into a Firecracker microVM with its own kernel and per-layer network policy.
- The broader message is that agent security is an architecture problem, not just a prompt problem.
More from coding & agent
- Codex tip: use Sol with Astra and Luna sub-agents to save usage — pvncher · 2026-09-11
- agents-best-practices: a provider-neutral Agent Skill for designing and auditing agentic harnesses — tom_doerr · 2026-09-11
- Cognition's SWE-2 uses a KKT duality argument in RL to shift the effort Pareto curve — YouJiacheng · 2026-09-11
- First-ever Three.js Conference lands in Paris, with a panel on AI-shortened design workflows — OdinLovis · 2026-09-11
- Data engineering, not agent frameworks, is the real bottleneck for enterprise AI agents — dhruv2038 · 2026-09-11
- RTK Terminal Compression Cuts Tokens but Leaves Your AI Coding Bill Unchanged — Bartaseth · 2026-09-11