We proactively fixed ~100 security issues in 6 days with 0 humans

Summary

Ramp Security Engineering describes a six-day experiment in which home-grown agents found, validated, and fixed nearly 100 latent backend security issues, including some high-severity findings, without human involvement until pull-request review. The issues had not been uncovered by penetration testing, bug bounty testing, static analysis, or trials of 10+ code-scanning vendors, and all were patched within a week of discovery. The pipeline used specialized vulnerability detectors, adversarial manager agents that rejected 40% of initial proposals in sample testing, integration tests for validation, and an internal coding agent that generated patches. Live interactive validation struggled with complex preconditions, so test-based validation became the main approach; a human team member still reviewed and landed each pull request.

Takeaways

1. 1

   Specialized detectors with focused context windows produced higher-signal initial findings than generic prompts or multipurpose detectors.

2. 2

   In sample testing, adversarial managers rejected 40% of detector proposals, and human review confirmed all rejected proposals were false positives.

3. 3

   Agents struggled to configure complex live-environment preconditions, so integration-test validation replaced interactive testing for most findings.