Some people object to defensive agents: won't this just create an endless loop of AI making problems and AI fixing them? Sometimes, yes. Let them. Let the agents fight each other rather than the developers.
If an AI coding agent introduces a subtle bug, and an AI testing agent catches it, and an AI debugging agent files the fix, that is a win. The code got better, and the developer had more time for other decisions. I care more about that than how much work the agents did along the way.
Is the only answer to security "humans moving slowly?" I don't think so. We need automated checks that keep up with the code we're writing. A team running continuous adversarial scans across every PR will find more issues, faster, than a team relying on a quarterly human review. Automated scans don't have to wait for someone to make time for a review.
I expect companies that use agents for both writing and reviewing code to ship faster and be more secure than companies relying on human-only review.
I've argued elsewhere that agentic defense is the missing half of the equation and that the slop framing is mostly status anxiety. We should be putting agents to work reviewing each other's code.
— Ry
Key takeaways
- Agents catching and fixing each other's mistakes can save developers time.
- Adversarial multi-agent loops surface more issues than single-agent review.
- Faster development needs automated security checks to keep up.
FAQ
Does agent-vs-agent review just create busywork?
A bug caught and fixed by agents is one a developer didn't have to debug. That's useful even if an agent introduced it in the first place.
Is the only answer to security humans moving slowly?
No. Continuous adversarial scanning lets teams check every PR for problems instead of waiting for periodic human review.
Related Essays
Agentic Defense: The Missing Half of the Equation
Put at least as much AI effort into securing, debugging, and testing as you put into building. Here is what that looks like.
Where AI Defense Is Headed
Two-thirds of your AI firepower belongs on debt, security, and testing. The teams building defensive infrastructure now will outpace teams that either reject AI or deploy it recklessly.
Put AI on Defense, Not Just Offense
Most developers use AI only to write code. The real opportunity is using AI to secure, debug, and test—deploying equal firepower on defense.