Shopify's River agent cut its vuln backlog 70% in 11 days
jevon · x · 2026-09-04
Shopify's infrastructure security team now runs River, an autonomous agent, to remediate dependency vulnerabilities. In the first 11 days:
- Open backlog down 70%
- 2/3 of that via direct merges
- The rest confirmed obsolete or already fixed elsewhere
- Security merges through the merge queue jumped from 10% to 80%
The author's point: writing a fix is the easy part—patches pile up awaiting review while the codebase changes underneath. River's job is getting each fix merged and confirming the vulnerability is actually gone.
Related event: Shopify's AI Agent River Cut 70% of Vulnerability Backlog in 11 Days(6 posts)→
More from coding & agent
- JSON prompting with MOSS Image 5B: bbox coordinates for exact multi-room layouts — cocktailpeanut · 2026-10-21
- Rewriting an agent skill: A/B challenge runs show skills should only add what agents don't know — jmschreiber91 · 2026-10-21
- Developer builds himself a 'Rork MoTS' agent on Grok Bot, aiming for full autonomy before GTA 6 — rudrank · 2026-10-21
- OpenAI Live API tip: control voice sessions from your backend via sideband WebSocket — pbbakkum · 2026-10-21
- OpenAI's MultiLangBench: PHP scores highest (91.3%) at building a database engine from scratch — ricklamers · 2026-10-21
- UserProof lets Claude Code watch your user session recordings and boost conversion for $29/mo — doooyle · 2026-10-21