Agent loops keep ~40 container images patched to zero CRITICAL/HIGH findings
Published
How does this AI workflow work?
- Replaces: hours every week of security, DevOps and service owners chasing scanner findings across about 40 container images.
- A ten-minute dependency bump often took half a day.
- What to connect: an agent loop per image family (Go, Bun, custom base images) that reads new scanner findings, edits the Dockerfiles and opens a PR.
- How it works: a CI gate rebuilds and re-scans every affected image, starts the container and checks its health probe. If the gate fails, the next run reads the log and fixes it.
- Results: Edge Delta runs this on its own AI Teammates.
- 30+ Go module bumps so far.
- A Bun service taken from 143 findings to zero.
- A Node 22 to 26 upgrade for a patched OpenSSL.
- Who it's for: platform, DevOps and security teams running many container images.
From the Morning Tokens issue of Oct 23, 2026