Why it matters
A single PatchPilot PR that bumped a few dependencies changed 70,000 lines of code, and the whole problem hides somewhere in that diff. Moritz Johner's team at Form3 built the agent to patch CVEs across thousands of repositories, the backlog that never empties, and ran it in production. Then infosec asked the question
My takeaway: We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3 is a threat-intelligence signal. The practical read is to connect the incident back to AI-adjacent software, developer tooling, and automation paths that need ordinary security controls.