We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3
Form3 deployed an AI agent with production code access to automate complex dependency patching at scale.
“You really want to have a tool that looks at the CVE and understands the full surface of it.”
Form3 gave an AI agent direct production code access to solve dependency patching across thousands of repositories, arguing that tools like Dependabot and Renovate fail because they only manipulate manifests and cannot reason about cascading effects (e.g., bumping a Go runtime requiring a linter bump that then breaks code). The agent must understand the full CVE surface and coordinate multi-step changes to reach a green CI. This is a concrete production case study of autonomous agents operating on real codebases at enterprise scale, making it a meaningful signal for teams evaluating agentic software engineering.