My rule of thumb: put at least as much AI effort into securing, debugging, and testing as you put into building. Two-thirds defense, one-third offense if you can swing it. Most teams are doing the opposite.
Here is what defense actually looks like.
Automated vulnerability scanning. Point AI at the codebase continuously, not as a quarterly audit. Most legacy vulnerabilities live in human-written code anyway. By the end of 2026, autonomous vulnerability detection is going to outperform the human security reviews of 2024 because it can check the code far more often.
Continuous debt reduction. Stand up a background agent whose job is to file one PR a day fixing type errors, dead code, or outdated tests. This work tends to get put off. Give an agent the assignment so it gets done regularly.
Exception-to-fix pipelines. Wire your Sentry stream into an agent. When something breaks in production, the agent picks it up, diagnoses, writes the patch, and opens the PR. You review and merge. That can bring the time to a fix down from days to hours. It's a practical use for agents in production.
Test generation with permission to execute. Do not just let agents write tests. Let them run the tests, watch them fail, and iterate until they pass. They need to check their own work.
I've argued elsewhere that the offense-only problem is what makes the security critics sound right even when their conclusion is wrong. These checks address those concerns. The tools are available, and you can get started with one of these workflows over a weekend.
— Ry
Key takeaways
- Put as much AI effort into testing and security as you put into building.
- Background agents can scan for vulnerabilities, file daily debt PRs, and convert exceptions into fixes.
- Give test agents permission to execute and iterate — not just write — so they catch their own mistakes.
FAQ
What does agentic defense look like in practice?
Continuous vulnerability scans, daily PRs targeting tech debt, exception-to-fix pipelines that turn Sentry alerts into pull requests, and test agents with permission to run and iterate until tests pass.
Why connect production exceptions to an agent?
Production breakage is the cheapest signal you have for what to fix next. Wiring exceptions directly into an agent that diagnoses, patches, and opens a PR turns days-long feedback loops into hours.
Related Essays
The Offense-Only Problem with AI Coding
Most developers deploy AI almost exclusively to ship features faster. The asymmetry is the problem — not the AI itself.
Let the Agents Fight Each Other
If a coding agent introduces a bug and a testing agent catches it and a debugging agent fixes it, that is a win. The developer saved time.
Where AI Defense Is Headed
Two-thirds of your AI firepower belongs on debt, security, and testing. The teams building defensive infrastructure now will outpace teams that either reject AI or deploy it recklessly.