Shopify's River AI agent cleared 70% of its vuln backlog in 11 days
jevon · x · 2026-09-04
Shopify details how River, its Slack-native AI agent, automates vulnerability remediation end to end.
How it works
- River operates from the root of Shopify's monorepo, reusing the same reproducible dev environments, written skills, and engineering conventions as human engineers.
- It first re-verifies each open finding against current code: about a third of the 'open' backlog was already fixed or no longer applied, and River closed those with evidence.
- It safely updates patches when possible, pulls in the right engineers for judgment calls, and only marks work done after checking the repo HEAD and dependency graph post-merge.
Results: In the first 11 days of the dependency workflow, the open-vulnerability backlog fell 70%, with roughly two-thirds directly merged. The team's thesis: attackers reuse techniques across targets, and defenders should too.
Related event: Shopify's AI Agent River Cut 70% of Vulnerability Backlog in 11 Days(6 posts)→
More from coding & agent
- Skills vs MCP vs RAG vs Memory: the four knowledge layers production agents need — MaryamMiradi · 2026-10-21
- When customer service bans AI agents, one goes incognito to fight Xfinity — MoonL88537 · 2026-10-21
- Every.to publishes raw interviews so readers can agent-check quotes in its Codex story — every · 2026-10-21
- One-prompt Blender: Voyager + Claude Opus 5.5 auto-connects to Blender and Unity — ravisparikh · 2026-10-21
- Aviation tracks every part's provenance — agents can reason over that graph — colinmcnamara · 2026-10-21
- Claude Code directed a full music video: 6.5 hours, 765M input tokens — colinmcnamara · 2026-10-21