AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80%
jevon · x · 2026-09-04
jevon explains the key insight behind River, an agent for security fixes: writing a patch is the easy part. Patches pile up waiting for review, the codebase shifts underneath them, and the vulnerability stays live. River's job is getting each fix merged and confirming the vuln is actually gone.
- Results after 11 days on dependency vulnerabilities:
- Open backlog down 70%
- 2/3 of those were direct merges
- The rest confirmed obsolete or already fixed elsewhere
- Security merges through the merge queue: 10% → 80%
Related event: Shopify's AI Agent River Clears 70% of Vulnerability Backlog in 11 Days(5 posts)→
More from coding & agent
- Opinion: AI Can Amplify Technical Debt — craigmullins · 2026-09-04
- Sandbox readiness is the new bottleneck in agentic apps; git as state primitive — w_hgm · 2026-09-04
- OSWorld Creator: From Operator to GPT-6 Astra on OSWorld 2.0 — TianbaoX · 2026-09-04
- Theo: GPT-6 Astra one-shots a 3D browser game, world-class at Blender and spatial reasoning — charliermarsh · 2026-09-04
- Astra agent runs for 8 straight days using 1,600+ subagents to build a custom Xiaomi ROM — zephyr_z9 · 2026-09-04
- Waterfall enrichment with Claude: agents pick data sources, from $0.005 per call vs $7,500/yr stack — SimplyAnnisa · 2026-09-04