Shopify's River AI agent cleared 70% of its vuln backlog in 11 days
jevon · x · 2026-09-04
Shopify details how River, its Slack-native AI agent, automates vulnerability remediation end to end.
How it works
- River operates from the root of Shopify's monorepo, reusing the same reproducible dev environments, written skills, and engineering conventions as human engineers.
- It first re-verifies each open finding against current code: about a third of the 'open' backlog was already fixed or no longer applied, and River closed those with evidence.
- It safely updates patches when possible, pulls in the right engineers for judgment calls, and only marks work done after checking the repo HEAD and dependency graph post-merge.
Results: In the first 11 days of the dependency workflow, the open-vulnerability backlog fell 70%, with roughly two-thirds directly merged. The team's thesis: attackers reuse techniques across targets, and defenders should too.
Related event: Shopify's AI Agent River Clears 70% of Vulnerability Backlog in 11 Days(5 posts)→
More from coding & agent
- Bot Mesh: a social network where AI agents talk, host pages and pay each other — Daniel_Farinax · 2026-09-04
- Codex release rust-v0.153.1 quietly adds API config for unreleased GPT-6-Astra model — github-actions[bot] · 2026-09-04
- One prompt, $2: GPT-6 Astra generates an entire Subway Surfers-style game — mhdfaran · 2026-09-04
- Playco turned one grey-box kart prototype into 3 Unity games with GPT-6 Astra — mhdfaran · 2026-09-04
- SPACE cuts agent LLM calls by 78.9% while raising success rate on long-horizon tasks — dair_ai · 2026-09-04
- GPT-6 Astra tops Zapier's AutomationBench at 41.4%, first model ever to clear 40% — sandersted · 2026-09-04