Software and security teams have never had to patch so much code so quickly. AI agents can generate vulnerability fixes in seconds, but pushing unverified, machine-authored code to production has led to trading a CVE for a production outage. To solve this problem, SRE principles are now gaining new traction in application security and development teams that realize mitigating one risk shouldn't create another. To benefit at all from agents in SSDLC, we need operational cultures that recognize reliability as a combined social and technical measure, rather than just another tooling challenge. In this talk, we’ll walk through the practical mechanics of safely remediating vulnerabilities with agents. We’ll cover how TDD provides the baseline contract to keep patches from breaking existing features, why symptom-based test coverage catches regressions traditional tests miss, and how sandboxed runtimes isolate untrusted agent execution. Finally, we’ll look at closing the loop with automated canary analysis and SLO-driven rollbacks so fixes can deploy without risking production. We'll stick to real scenarios that helped us patch hundreds of repositories without breaking any relying applications (at least as far as users could tell).
Aron Eidelman is a Senior Developer Relations Engineer and Security Advocate at Google. He works on AI software security, leading developer enablement for Google's AI Threat Defense program, CodeMender, and Antigravity security skills. He co-authored Kaggle's "5 Days of AI Agents" curriculum, which trained over 350,000 developers globally in secure coding. Aron is a frequent speaker on secure software development, with recent talks at Google Cloud Next '26 and the Zenity AI Agent Security Summit. Outside of Google, Aron serves as the Chairman of Azure Printed Homes. The company 3D prints modular housing from recycled plastic, repurposing 150,000 plastic bottles per unit for wildfire recovery projects in LA and a new 62-unit housing village in San Luis Obispo.
