---
title: "We proactively fixed ~100 security issues in 6 days with 0 humans"
description: "Ramp Security Engineering describes a six-day experiment in which home-grown agents found, validated, and fixed nearly 100 latent backend security issues, including some high-severity findings, without human involvement until pull-request review. The issues had not been uncovered by penetration testing, bug bounty testing, static analysis, or trials of 10+ code-scanning vendors, and all were patched within a week of discovery. The pipeline used specialized vulnerability detectors, adversarial manager agents that rejected 40% of initial proposals in sample testing, integration tests for validation, and an internal coding agent that generated patches. Live interactive validation struggled with complex preconditions, so test-based validation became the main approach; a human team member still reviewed and landed each pull request."
---

# We proactively fixed ~100 security issues in 6 days with 0 humans

[Ramp](https://yomu.fyi/company/ramp) · Eli Block · Feb 20, 2026

**Type:** Tutorial

## Summary

Ramp Security Engineering describes a six-day experiment in which home-grown agents found, validated, and fixed nearly 100 latent backend security issues, including some high-severity findings, without human involvement until pull-request review. The issues had not been uncovered by penetration testing, bug bounty testing, static analysis, or trials of 10+ code-scanning vendors, and all were patched within a week of discovery. The pipeline used specialized vulnerability detectors, adversarial manager agents that rejected 40% of initial proposals in sample testing, integration tests for validation, and an internal coding agent that generated patches. Live interactive validation struggled with complex preconditions, so test-based validation became the main approach; a human team member still reviewed and landed each pull request.

## Context

Tooling-based security programs require people to find, validate, fix, and confirm findings, creating labor-intensive handoffs and organizational bottlenecks. The post says this burden can cause teams to ignore lower-severity issues and erode trust when effort is spent on low-impact findings.

## Approach / What changed

A coordinator launched specialized detector agents in parallel, then passed findings to adversarial manager agents for critique. A validator wrote integration tests that reproduced vulnerabilities and confirmed fixes, while an internal coding agent used those tests to generate patches and open pull requests for human review.

## Takeaways

- Specialized detectors with focused context windows produced higher-signal initial findings than generic prompts or multipurpose detectors.
- In sample testing, adversarial managers rejected 40% of detector proposals, and human review confirmed all rejected proposals were false positives.
- Agents struggled to configure complex live-environment preconditions, so integration-test validation replaced interactive testing for most findings.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Architecture](https://yomu.fyi/topic/architecture), [Security](https://yomu.fyi/topic/security), [Testing](https://yomu.fyi/topic/testing)

- Source: [Ramp](https://builders.ramp.com/post/100-vulnerabilities-patched-with-0-humans)
- Source URL: https://builders.ramp.com/post/100-vulnerabilities-patched-with-0-humans
- Ingested by Yomu: 2026-09-01T01:34:52.850Z

[Read original post](https://builders.ramp.com/post/100-vulnerabilities-patched-with-0-humans)