Shopify sends AI agents to attack its own production systems

A security team cannot test what an attacker will think of. Shopify's answer is to let an AI agent think of it for them. The agent then runs the attacks on Shopify's own systems.

Shopify Engineering published the design of Cyber Chaos Monkey on 12 November 2026. The post describes a two-agent system. The system reads Shopify's source code, threat reports and past bug tickets. It finds a candidate weakness. It then tests the weakness against production services through a controlled path. The post names the rules, the guardrails, and what came out of the first runs.

What it does

An Executor agent proposes an attack and runs it. It reads production logs. It makes live requests through a credential proxy and an egress proxy. It tries again when a response suggests a weakness. A Judge agent watches every tool call. The Judge stops a run that drifts from the stated goal. Shopify says both agents are frontier models, without naming which ones.

The whole system runs in Kubernetes-isolated containers on Debian with security tools pre-installed. Credentials are scoped tightly. A mistake cannot reach a service that was not part of the test.

The numbers

Shopify reports "tens of thousands of offensive engagements". It reports "dozens of impactful findings" since starting the program. The agents caused no outages or incidents. Bug bounty submissions have grown "almost 300 percent since 2024" on the external program. All three numbers are Shopify's own.

The post does not say what share of findings were real weaknesses. It does not say what share were false positives. It does not say what each run costs. It names no specific bug.

The design worth copying

Two choices carry most of the safety. The pair of agents gives a mistake two checks. The Executor has to decide to do something unsafe. The Judge has to approve it. The credential and egress proxies protect Shopify's real data stores. A compromised Executor cannot reach them without a signed request through the proxy. The proxy logs every call. Shopify calls this "two-person integrity", a banking phrase.

The second choice is the sandbox the agents run in. The containers hold the attack tools, but nothing that touches a real Shopify system. A human approves the final step before any change is permanent.

What this means

For an AI team thinking about letting an agent touch production, this is a published worked example. Something to argue from in a real design review. The shape is narrow credentials. Two agents watching each other. A sandbox around the whole thing. An audit log of every tool call. Shopify's own numbers are a starting floor to beat. They are the team's own measurement, so treat them as a reference line. The cost per run is missing. The false positive rate is not stated.

A team copying this on a smaller codebase will not find dozens of real bugs in the first month. The controls that stop the agent from breaking Shopify are the same ones that stop it in a smaller shop.

Source

Cyber Chaos Monkey: Staying ahead of security threats with AI agents, Shopify Engineering.