Shopify's AI Slack agent cut its vulnerability backlog by ~70% in 11 days
jevon · x · 2026-09-04
Shopify details how River, its AI agent living in Slack, drives vulnerability remediation end-to-end: checking findings against current code, safely updating patches, pulling in the right engineers for risk decisions, and verifying the repo head and dependency graph after merge.
- In the first 11 days, the open dependency-vulnerability backlog fell 70%
- Roughly two-thirds were direct merges
- Key insight: a good patch isn't a fixed vulnerability — the agent verifies risk is gone from the monorepo head
- The team shares reusable lessons for other security teams
Related event: Shopify's AI Agent River Cut 70% of Vulnerability Backlog in 11 Days(6 posts)→
More from coding & agent
- PostgreSQL 19 slips to November as LLM-assisted code review floods committers with edge cases — sanjaykalra · 2026-10-21
- LangChain adds Human-in-the-Loop beta to Managed Deep Agents — LangChain · 2026-10-21
- Voxtral 3 ships a LiveKit-based voice agent SDK streaming listen-think-speak — MistralAI · 2026-10-21
- Open-sourced pixel art normals generator ships as Rust CLI and wasm library — HugoDuprez · 2026-10-20
- Eval researcher teases guide to subjective-task evals, with a curated resource list — cwolferesearch · 2026-10-20
- Eon cuts engineer onboarding from 2 days to 2 minutes with an MCP Gateway on Bedrock AgentCore — AWS ML Blog · 2026-10-20