← back
We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3
Takeaway
Production patching agents should operate inside deterministic orchestration that limits edits and owns publication, verification, and escalation.
Summary
- Form3's Patch Pilot addresses vulnerabilities hidden in container base images and downloaded binaries, plus coupled dependency changes that ordinary manifest updates leave unresolved.
- A deterministic Go controller scans OCI images, maps them to repositories, and delegates bounded remediation and CI diagnosis to coding agents.
- Agents modify local files and verify minimal CVE fixes; the controller vets changes, commits, pushes, opens PRs, and watches CI.
- CI remediation runs in a bounded retry loop with human escalation, while short agent retrospectives reveal recurring missing tools and context.
dependency-patchingcoding-agentssupply-chain-security
Original description
A single PatchPilot PR that bumped a few dependencies changed 70,000 lines of code, and the whole problem hides somewhere in that diff. Moritz Johner's team at Form3 built the agent to patch CVEs across thousands of repositories, the backlog that never empties, and ran it in production. Then infosec asked the question that reframes the whole project: is this automation, or a supply chain incident waiting to happen? The moment a coding agent has the repository access, CI logs, credentials, and Docker socket it needs to be useful, it becomes a supply chain actor, whether you planned for that or not. Their answer is architectural. PatchPilot splits in two: a boring deterministic Go layer that keeps the dangerous powers, GitHub write access and the ability to trigger CI, and an agent layer that only edits files on disk and hands control back. Where you draw that line is the actual security model, because it caps the blast radius when the agent gets prompt injected by one of the 70,000 lines it did not write. The Docker socket is the part that kept him up at night: hand it over so the agent can build and verify its own work, and a prompt injection can break out into a privileged container, so they moved the whole thing inside a firecracker microVM with its own kernel and a separate network policy for each layer. Speaker info: / moritz-johner https://github.com/moolen https://github.com/external-secrets/e...