Form3 split its production patching agent to keep GitHub writes and CI out of the model layer

AI Engineer · youtube · 2026-07-21

This Form3 talk argues that once an AI agent can touch repositories, CI logs, credentials, and Docker sockets, it becomes part of the software supply chain whether you planned it or not.

A single PatchPilot PR changed about 70,000 lines across repositories, which exposed the core issue: the danger is not just what the agent edits, but what it can reach.
Form3 split the system into two layers: a deterministic Go layer keeps dangerous powers such as GitHub writes and CI triggers, while the agent layer only edits files on disk.
To reduce the blast radius from prompt injection and container escape risk, the team moved execution into a Firecracker microVM with its own kernel and per-layer network policy.
The broader message is that agent security is an architecture problem, not just a prompt problem.

Original post →

Form3 split its production patching agent to keep GitHub writes and CI out of the model layer

More from coding & agent