--- schema: 1 type: video title: >- We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3 description: >- A single PatchPilot PR that bumped a few dependencies changed 70,000 lines of code, and the whole problem hides somewhere in that diff. Moritz Johner's team at Form3 built the agent to patch CVEs across thousands of repositories, the backlog that never empties, and ran it in production. Then infosec asked the question that reframes the whole project: is this automation, or a supply chain incident waiting to happen? The moment a coding agent has the repository access, CI logs, credentials, and Docker socket it needs to be useful, it becomes a supply chain actor, whether you planned for that or not. Their answer is architectural. PatchPilot splits in two: a boring deterministic Go layer that keeps the dangerous powers, GitHub write access and the ability to trigger CI, and an agent layer that only edits files on disk and hands control back. Where you draw that line is the actual security model, because it caps the blast radius when the agent gets prompt injected by one of the 70,000 lines it did not write. The Docker socket is the part that kept him up at night: hand it over so the agent can build and verify its own work, and a prompt injection can break out into a privileged container, so they moved the whole thing inside a firecracker microVM with its own kernel and a separate network policy for each layer. Speaker info: - https://www.linkedin.com/in/moritz-johner/ - https://github.com/moolen - https://github.com/external-secrets/external-secrets canonical: 'https://liquidgold.cc/watch/LqLoYksJ6do' markdown: 'https://liquidgold.cc/watch/LqLoYksJ6do.md' llms: 'https://liquidgold.cc/watch/LqLoYksJ6do/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T07:07:57.516Z' language: null children: [] videoId: LqLoYksJ6do durationSeconds: 1317 publishedAt: '2026-07-20T17:17:53.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 26 endSeconds: 156 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=26' heldReason: rights - ordinal: 1 text: null startSeconds: 26 endSeconds: 156 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=26' heldReason: rights - ordinal: 2 text: null startSeconds: 26 endSeconds: 156 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=26' heldReason: rights - ordinal: 3 text: null startSeconds: 26 endSeconds: 156 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=26' heldReason: rights - ordinal: 4 text: null startSeconds: 167 endSeconds: 298 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=167' heldReason: rights - ordinal: 5 text: null startSeconds: 167 endSeconds: 298 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=167' heldReason: rights - ordinal: 6 text: null startSeconds: 167 endSeconds: 298 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=167' heldReason: rights - ordinal: 7 text: null startSeconds: 167 endSeconds: 298 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=167' heldReason: rights - ordinal: 8 text: null startSeconds: 309 endSeconds: 400 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=309' heldReason: rights - ordinal: 9 text: null startSeconds: 309 endSeconds: 400 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=309' heldReason: rights - ordinal: 10 text: null startSeconds: 410 endSeconds: 523 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=410' heldReason: rights - ordinal: 11 text: null startSeconds: 410 endSeconds: 523 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=410' heldReason: rights - ordinal: 12 text: null startSeconds: 410 endSeconds: 523 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=410' heldReason: rights - ordinal: 13 text: null startSeconds: 523 endSeconds: 533 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=523' heldReason: rights - ordinal: 14 text: null startSeconds: 533 endSeconds: 629 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=533' heldReason: rights - ordinal: 15 text: null startSeconds: 533 endSeconds: 629 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=533' heldReason: rights - ordinal: 16 text: null startSeconds: 639 endSeconds: 742 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=639' heldReason: rights - ordinal: 17 text: null startSeconds: 742 endSeconds: 753 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=742' heldReason: rights - ordinal: 18 text: null startSeconds: 753 endSeconds: 873 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=753' heldReason: rights - ordinal: 19 text: null startSeconds: 753 endSeconds: 873 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=753' heldReason: rights - ordinal: 20 text: null startSeconds: 753 endSeconds: 873 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=753' heldReason: rights - ordinal: 21 text: null startSeconds: 885 endSeconds: 983 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=885' heldReason: rights - ordinal: 22 text: null startSeconds: 885 endSeconds: 983 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=885' heldReason: rights - ordinal: 23 text: null startSeconds: 994 endSeconds: 1083 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=994' heldReason: rights - ordinal: 24 text: null startSeconds: 994 endSeconds: 1083 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=994' heldReason: rights - ordinal: 25 text: null startSeconds: 1083 endSeconds: 1095 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=1083' heldReason: rights - ordinal: 26 text: null startSeconds: 1095 endSeconds: 1184 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=1095' heldReason: rights - ordinal: 27 text: null startSeconds: 1095 endSeconds: 1184 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=1095' heldReason: rights - ordinal: 28 text: null startSeconds: 1184 endSeconds: 1195 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=1184' heldReason: rights - ordinal: 29 text: null startSeconds: 1195 endSeconds: 1317 watch: 'https://liquidgold.cc/watch/LqLoYksJ6do?t=1195' heldReason: rights --- # We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3 A single PatchPilot PR that bumped a few dependencies changed 70,000 lines of code, and the whole problem hides somewhere in that diff. Moritz Johner's team at Form3 built the agent to patch CVEs across thousands of repositories, the backlog that never empties, and ran it in production. Then infosec asked the question that reframes the whole project: is this automation, or a supply chain incident waiting to happen? The moment a coding agent has the repository access, CI logs, credentials, and Docker socket it needs to be useful, it becomes a supply chain actor, whether you planned for that or not. Their answer is architectural. PatchPilot splits in two: a boring deterministic Go layer that keeps the dangerous powers, GitHub write access and the ability to trigger CI, and an agent layer that only edits files on disk and hands control back. Where you draw that line is the actual security model, because it caps the blast radius when the agent gets prompt injected by one of the 70,000 lines it did not write. The Docker socket is the part that kept him up at night: hand it over so the agent can build and verify its own work, and a prompt injection can break out into a privileged container, so they moved the whole thing inside a firecracker microVM with its own kernel and a separate network policy for each layer. Speaker info: - https://www.linkedin.com/in/moritz-johner/ - https://github.com/moolen - https://github.com/external-secrets/external-secrets Canonical: https://liquidgold.cc/watch/LqLoYksJ6do · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.