We proactively fixed ~100 security issues in 6 days with 0 humans

Summary

Ramp Security Engineering describes a six-day experiment in which home-grown agents found, validated, and fixed nearly 100 latent backend security issues, including some high-severity findings, without human involvement until pull-request review. The issues had not been uncovered by penetration testing, bug bounty testing, static analysis, or trials of 10+ code-scanning vendors, and all were patched within a week of discovery. The pipeline used specialized vulnerability detectors, adversarial manager agents that rejected 40% of initial proposals in sample testing, integration tests for validation, and an internal coding agent that generated patches. Live interactive validation struggled with complex preconditions, so test-based validation became the main approach; a human team member still reviewed and landed each pull request.

Context

Tooling-based security programs require people to find, validate, fix, and confirm findings, creating labor-intensive handoffs and organizational bottlenecks. The post says this burden can cause teams to ignore lower-severity issues and erode trust when effort is spent on low-impact findings.

Approach / What changed

A coordinator launched specialized detector agents in parallel, then passed findings to adversarial manager agents for critique. A validator wrote integration tests that reproduced vulnerabilities and confirmed fixes, while an internal coding agent used those tests to generate patches and open pull requests for human review.

Takeaways

• Specialized detectors with focused context windows produced higher-signal initial findings than generic prompts or multipurpose detectors.
• In sample testing, adversarial managers rejected 40% of detector proposals, and human review confirmed all rejected proposals were false positives.
• Agents struggled to configure complex live-environment preconditions, so integration-test validation replaced interactive testing for most findings.

Related reading