Shopify's AI Slack agent cut its vulnerability backlog by ~70% in 11 days
jevon · x · 2026-09-04
Shopify details how River, its AI agent living in Slack, drives vulnerability remediation end-to-end: checking findings against current code, safely updating patches, pulling in the right engineers for risk decisions, and verifying the repo head and dependency graph after merge.
- In the first 11 days, the open dependency-vulnerability backlog fell 70%
- Roughly two-thirds were direct merges
- Key insight: a good patch isn't a fixed vulnerability — the agent verifies risk is gone from the monorepo head
- The team shares reusable lessons for other security teams
Related event: Shopify's AI Agent River Cuts Vulnerability Backlog 70% in 11 Days(6 posts)→
More from coding & agent
- Open Notebook: An Open-Source NotebookLM Alternative That Runs Locally With 4-Speaker Podcasts — aigleeson · 2026-09-04
- mitsuhiko: npm's slow propagation forces pi releases to wait ~30 minutes — mitsuhiko · 2026-09-04
- Hunyuan 4 preview tested: multi-agent combat and Agentic Coding score jumps from 16 to 10,779 — karminski3 · 2026-09-04
- 675 MCP Servers Scored on Security: 89% Fail, Only 6 Deemed Safe — Low_Location1261 · 2026-09-04
- The Evolution of the Agent Harness: Models Are Absorbing Scaffolding Into Their Weights — daniel_mac8 · 2026-09-04
- Open-source CLI Ship Safe audits LLM agent supply-chain risks: only 1 of 4 sampled alerts held up — DiscussionHealthy802 · 2026-09-04