AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80%
jevon · x · 2026-09-04
jevon explains the key insight behind River, an agent for security fixes: writing a patch is the easy part. Patches pile up waiting for review, the codebase shifts underneath them, and the vulnerability stays live. River's job is getting each fix merged and confirming the vuln is actually gone.
- Results after 11 days on dependency vulnerabilities:
- Open backlog down 70%
- 2/3 of those were direct merges
- The rest confirmed obsolete or already fixed elsewhere
- Security merges through the merge queue: 10% → 80%
Related event: Shopify's AI Agent River Cut 70% of Vulnerability Backlog in 11 Days(6 posts)→
More from coding & agent
- LukeW built an agent-orchestration app for a foldable: managing agents is now an all-day job — LukeW · 2026-10-21
- Agentic SDLC: engineers shift from implementers to agent orchestrators as cycles shrink from weeks to hours — Pavan_Belagatti · 2026-10-21
- OpenAI's dots can now use company tools via Merge for Workforce with employee-bound permissions — shensi · 2026-10-21
- The topology of an LLM agent: where the model, loop, and tools run shapes cost and security — davidcrawshaw · 2026-10-21
- Agents with full-disk and accessibility access are an enterprise security nightmare, argues Runlayer — leveragedupside · 2026-10-21
- Acellera runs an unsupervised virtual lab of AI scientists on a real IL-23 molecular discovery program — gdefabritiis · 2026-10-21