{
  "apiVersion": "v1",
  "topic": {
    "id": "security",
    "title": "How does AI help keep a product secure?",
    "summary": "AI used to find vulnerabilities, review security, and the risks agents add.",
    "group": "Building software",
    "aliases": [
      "vulnerabilities",
      "appsec",
      "security review"
    ]
  },
  "passages": [
    {
      "id": "atlassian-atlassian-agent-loops-jira-automatically-resolve-51-2026",
      "text": "At Atlassian, agent loops in Jira automatically resolve 51% of potential vulnerabilities",
      "speaker": null,
      "role": null,
      "organization": "Atlassian",
      "aiVendor": false,
      "work": {
        "title": "Atlassian (own site)",
        "type": "post",
        "date": "2026-10-01",
        "publisher": "Atlassian (own site)",
        "url": "https://www.atlassian.com/blog/ai-at-work/ai-sdlc-transformation-playbook"
      },
      "grade": "B",
      "verification": {
        "status": "verified",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "security"
      ],
      "functions": [
        "security"
      ],
      "figures": [
        {
          "metric": "function-agent-share",
          "value": 0.51,
          "unit": "share",
          "period": "not stated",
          "definition": "security: potential vulnerabilities resolved by agent loops in Jira",
          "level": "unclear"
        }
      ],
      "context": null,
      "url": "https://the-ai-record.com/passages/atlassian-atlassian-agent-loops-jira-automatically-resolve-51-2026"
    },
    {
      "id": "shopify-first-11-days-running-dependency-workflow-backlog-2026",
      "text": "In the first 11 days of running the dependency workflow, the backlog of open issues fell by about 70%.",
      "speaker": "Erin Son",
      "role": "Senior Engineer",
      "organization": "Shopify",
      "aiVendor": false,
      "work": {
        "title": "How River takes security work from a fix to merge",
        "type": "post",
        "date": "2026-09-02",
        "publisher": "Shopify engineering blog",
        "url": "https://shopify.engineering/river-vulnerability-remediation"
      },
      "grade": "B",
      "verification": {
        "status": "verified",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "developer-productivity",
        "measuring-impact",
        "security"
      ],
      "functions": [
        "security",
        "engineering"
      ],
      "figures": [
        {
          "metric": "output-change",
          "value": -0.7,
          "unit": "share",
          "period": "first 11 days of the dependency workflow, as of 2026-09-02",
          "definition": "backlog of open dependency issues after River's dependency workflow started",
          "level": "n/a"
        }
      ],
      "context": null,
      "url": "https://the-ai-record.com/passages/shopify-first-11-days-running-dependency-workflow-backlog-2026"
    },
    {
      "id": "shopify-since-launch-security-merges-through-freshness-gated-2026",
      "text": "Since launch, security merges through our freshness-gated merge queue went from about 10% to 80%.",
      "speaker": "Erin Son",
      "role": "Senior Engineer",
      "organization": "Shopify",
      "aiVendor": false,
      "work": {
        "title": "How River takes security work from a fix to merge",
        "type": "post",
        "date": "2026-09-02",
        "publisher": "Shopify engineering blog",
        "url": "https://shopify.engineering/river-vulnerability-remediation"
      },
      "grade": "B",
      "verification": {
        "status": "verified",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "security"
      ],
      "functions": [
        "security",
        "engineering"
      ],
      "figures": [
        {
          "metric": "function-agent-share",
          "value": 0.8,
          "unit": "share",
          "period": "since launch, as of 2026-09-02",
          "definition": "security: share of security merges going through the freshness-gated merge queue, up from about 10%",
          "level": "human-approves"
        }
      ],
      "context": null,
      "url": "https://the-ai-record.com/passages/shopify-since-launch-security-merges-through-freshness-gated-2026"
    },
    {
      "id": "shopify-over-roughly-six-weeks-weve-run-thousands-2026",
      "text": "Over roughly six weeks, we’ve run thousands of scans, produced over 300 findings ranging from defense-in-depth improvements to resolved security incidents.",
      "speaker": "Zack Deveau",
      "role": "Title not stated on Deveau's author page; the post is written from Shopify's Application Security team",
      "organization": "Shopify",
      "aiVendor": false,
      "work": {
        "title": "Building an agentic harness that outlasts the model",
        "type": "post",
        "date": "2026-07-29",
        "publisher": "Shopify engineering blog",
        "url": "https://shopify.engineering/building-an-agentic-harness-that-outlasts-the-model"
      },
      "grade": "B",
      "verification": {
        "status": "verified",
        "reviewedOn": "2026-10-31"
      },
      "topics": [
        "bugs-and-incidents",
        "testing",
        "security"
      ],
      "functions": [
        "security"
      ],
      "figures": [
        {
          "metric": "function-agent-volume",
          "value": 300,
          "unit": "count",
          "period": "about six weeks, as of 2026-07-29",
          "definition": "application security: findings produced by an agent harness that scans public-facing apps",
          "level": "unclear"
        }
      ],
      "context": null,
      "url": "https://the-ai-record.com/passages/shopify-over-roughly-six-weeks-weve-run-thousands-2026"
    },
    {
      "id": "block-builderbot-operates-source-code-system-configuration-2026",
      "text": "It also operates on source code and system configuration only; it does not access or process customer data, payment information, or personally identifiable information.",
      "speaker": null,
      "role": null,
      "organization": "Block",
      "aiVendor": false,
      "work": {
        "title": "Block rolls out BuilderBot, a new suite of AI-native tools that changes the way we ship",
        "type": "post",
        "date": "2026-06-17",
        "publisher": "Block (own site)",
        "locator": "How it works",
        "url": "https://block.xyz/inside/block-rolls-out-builderbot-a-new-suite-of-ai-native-tools-that-changes-the-way-we-ship"
      },
      "grade": "B",
      "verification": {
        "status": "verified",
        "reviewedOn": "2026-11-01"
      },
      "topics": [
        "security",
        "autonomy-and-oversight"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [],
      "context": null,
      "url": "https://the-ai-record.com/passages/block-builderbot-operates-source-code-system-configuration-2026"
    },
    {
      "id": "cloudflare-security-agent-processes-over-7-billion-tokens-2026",
      "text": "we have a security agent that processes over 7 billion tokens per day on Kimi. That would cost an estimated $2.4M per year on a mid-tier proprietary model. But on Workers AI, it’s 77% cheaper.",
      "speaker": null,
      "role": null,
      "organization": "Cloudflare",
      "aiVendor": true,
      "work": {
        "title": "The AI engineering stack we built internally, on the platform we ship",
        "type": "post",
        "date": "2026-04-20",
        "publisher": "Cloudflare blog",
        "locator": "Act 1, \"How we increasingly leverage Workers AI\"",
        "url": "https://blog.cloudflare.com/internal-ai-engineering-stack/"
      },
      "grade": "B",
      "verification": {
        "status": "reported"
      },
      "topics": [
        "ai-cost-and-spend",
        "security"
      ],
      "functions": [
        "engineering"
      ],
      "figures": [
        {
          "metric": "tokens-per-day",
          "value": 7000000000,
          "unit": "count",
          "period": "per day, security agent on Kimi K2.5",
          "definition": "Tokens processed by an internal security agent (stated as over 7 billion)",
          "level": "n/a"
        },
        {
          "metric": "cost-saving",
          "value": 0.77,
          "unit": "share",
          "period": "versus an estimated $2.4M per year on a mid-tier proprietary model",
          "definition": "Stated saving from running the security agent on Workers AI, Cloudflare's own product",
          "level": "n/a"
        }
      ],
      "context": "Cloudflare sells Workers AI, the product it describes running this agent on.",
      "url": "https://the-ai-record.com/passages/cloudflare-security-agent-processes-over-7-billion-tokens-2026"
    }
  ],
  "notice": [
    "Every passage is reproduced word for word from the cited source.",
    "Check the verification status: \"reported\" means not yet confirmed by an independent second reader.",
    "Organizations flagged aiVendor sell AI tooling and have a reason to publish flattering numbers.",
    "An empty result means the archive holds nothing on it, not that nobody has said anything."
  ]
}