We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3

Summary

Moritz Johner explica el reto de automatizar la gestión de vulnerabilidades (CVEs) en una empresa con miles de repositorios. El problema no es solo aplicar parches, sino entender el contexto técnico y resolver fallos de CI/CD, lo que llevó a su equipo a crear 'Patch Pilot', un sistema híbrido que separa la lógica determinista (orquestación segura) de la lógica agente (razonamiento basado en LLMs). La charla se centra en cómo tratar a estos agentes como actores de la cadena de suministro, aplicando arquitecturas de aislamiento mediante micro-VMs para mitigar riesgos de seguridad como la inyección de prompts y el escape de contenedores.

Topics covered

• Limitaciones de las herramientas tradicionales
• Complejidad en la resolución de dependencias

+6 more topics (full content when you follow the channel)

Transcript excerpt

[music] >> Thanks everyone for joining in. Um thanks for the great intro, by the way. Um So, yeah. My talk today is about um so titles we give in Asia production code access and then try to sleep at night. Um so, it's mostly around dependency dependency patching, which is probably the most glamorous problem in software engineering. I guess everyone did it here at some point in the past. Um it really is like vacuuming. Like everyone loves it, can't wait to do do it again next week. Now, at our scale, we have thousands of repositories and it really is a backlog that never empties and you close 10 issues today and you know next week 20 more will arrive and you have to deal with them. So, naturally you think, "Sure. Let's just automate it. Dependabot exists. Renovate exists. Problem solved, right?" It isn't. Cuz these tools were really built for a world where fixing a CVE means um um looking…