Shopify's River agent cut its vuln backlog 70% in 11 days
jevon · x · 2026-09-04
Shopify's infrastructure security team now runs River, an autonomous agent, to remediate dependency vulnerabilities. In the first 11 days:
- Open backlog down 70%
- 2/3 of that via direct merges
- The rest confirmed obsolete or already fixed elsewhere
- Security merges through the merge queue jumped from 10% to 80%
The author's point: writing a fix is the easy part—patches pile up awaiting review while the codebase changes underneath. River's job is getting each fix merged and confirming the vulnerability is actually gone.
Related event: Shopify's AI Agent River Clears 70% of Vulnerability Backlog in 11 Days(5 posts)→
More from coding & agent
- Bot Mesh: a social network where AI agents talk, host pages and pay each other — Daniel_Farinax · 2026-09-04
- Codex release rust-v0.153.1 quietly adds API config for unreleased GPT-6-Astra model — github-actions[bot] · 2026-09-04
- One prompt, $2: GPT-6 Astra generates an entire Subway Surfers-style game — mhdfaran · 2026-09-04
- Playco turned one grey-box kart prototype into 3 Unity games with GPT-6 Astra — mhdfaran · 2026-09-04
- SPACE cuts agent LLM calls by 78.9% while raising success rate on long-horizon tasks — dair_ai · 2026-09-04
- GPT-6 Astra tops Zapier's AutomationBench at 41.4%, first model ever to clear 40% — sandersted · 2026-09-04