So I went down a rabbit hole this weekend. Some of you probably saw the thesis floating around that AI code generation is going to bury us in vulnerable code, attackers are already running agents against OSS at scale, review hours don't scale, etc. Standard doomer stuff, mostly agree with it, whatever.

What I hadn't seen is anyone on the defense side actually doing something about it that isn't a product demo. Then I found the disclosure log for this framework called Aeon: https://www.aeon.fun/security

70 repos. Alibaba, Tencent, a Vercel Labs project, a bunch of AI/agent infra stuff. Combined it's over 2M stars worth of code. The agent scans, writes the fix, opens a PR or files a private advisory, and follows it to merge. Unattended.

My first reaction was "sure it does" so I spent an hour clicking through the actual PRs expecting to find dependency bumps dressed up as security work. Some are dep bumps to be fair. But a lot of it is real: DNS rebinding fixes, an SSRF guard bypass, a microVM escape in a Tencent sandbox project rated critical, stored XSS in an electron app. The maintainers merged these. One of the repos is literally top 15 on github by stars.

The framework itself is open source (github.com/aeonfun/aeon), runs on github actions of all things, the whole agent is just a repo. Which weirdly is what makes me trust it more than most agent stuff - everything it does is a commit or a PR so you can audit every single action it's ever taken. Findings go to maintainers privately, not blogged for clout.

The thing I keep chewing on: we spend all this time asking whether autonomous agents can be trusted, and meanwhile maintainers of massive repos are reviewing agent-written security patches and merging them. Dozens of times. Is a merged PR in someone else's critical repo the best trust signal an agent can earn?