Geoffrey Huntley： Patch the Planet With Nix and Agents

Summary

Geoffrey Huntley argues that engineering systems for fast security response can also make software delivery faster. As AI agents write and scan more code, he expects automated vulnerability discovery and exploitation to become routine—and says organizations may need substantial inference capacity to defend themselves.

Libraries, agents, and patching

• Huntley questions the usual reliance on open-source libraries. His argument is that libraries were valuable when writing code was costly, but agents can now produce small, well-defined components tailored to a project.
• He does not advocate replacing trusted foundational software such as the kernel, DNS, or cryptography. For other dependencies, he suggests either generating a small component with an agent or vendoring and adapting existing software.
• His central technique, which he calls “Patch the Planet,” uses Nix to apply custom patches across software environments. Instead of waiting for an upstream maintainer to merge a fix, teams can patch a dependency themselves.

Nix as a shared build and deployment system

• Nix has existed for years but is often considered difficult to learn. Huntley’s point is that agents can lower that barrier: developers can ask an agent to set up Nix, Bazel, or Buck2 without first undertaking a major organizational training effort.
• In the Nix-Demo example, a dev-env configuration defines packages and services. It can be used to produce consistent developer environments, CI/CD setups, agent sandboxes, and production Docker images. This creates a shared source of truth and reduces environment drift.
• Nix can apply an overlay—a set of custom package changes—to a dependency and its transitive dependencies. Huntley demonstrates a patched Git build that removes force-push support, making that capability unavailable wherever the build is used.
• He also describes Nix’s caching and remote-building features: CI can build and publish artifacts to a cache for development environments and sandboxes to reuse. Nix-generated Docker images can use the dependency graph to produce optimized images.
• For security incidents, his proposed workflow is to ask an agent whether the software fleet is affected, patch or update the relevant dependencies centrally, rebuild affected software, and later remove temporary patches once an upstream fix is available. He describes tracking that cleanup in AGENTS.md.

Testing and safeguards for agent workflows

• Huntley uses disposable development machines where agents can have broad permissions, but explicitly warns against running agents as root on production hosts or connecting them to production databases.
• NixOS-Test can create test systems and networks—such as web servers behind a load balancer—to verify infrastructure behavior. With infrastructure defined in Nix, teams can create preview environments resembling production and test changes before deployment. He recommends careful database duplication and restricted outbound networking for reproduction workflows.
• He advocates deterministic checks, such as pre-commit hooks, compilation checks, static analysis, and architectural rules, to prevent agents from committing or pushing invalid changes. These checks can reduce reliance on manual code review.
• He recommends property-based testing in addition to ordinary unit tests. Rather than testing only hand-selected examples, a generator explores many inputs and checks that a specified property remains true. He gives examples involving Unicode string reversal and ensuring a customer receives a refund only once.
• He presents Bombadil, a browser-testing tool, as a property-based alternative to Playwright. It varies browser conditions and interactions, checks whether a behavior still holds, and can provide a reproducible counterexample when it fails.
• He also mentions Hegel, a Rust core with language-specific layers, and compares it with its predecessor, Hypothesis.

Guides, demos, and other material

• The talk includes a practical demonstration and points viewers to the Nix-Demo repository: github.com/ghuntley/nixdemo.
• Huntley also promotes the Bug Bash YouTube channel, which he says features technical talks about software engineering and software factories.
• An announcement for a future AI Dev Con event in London is included; it is promotional rather than a technical tutorial.

Main speaker and sources

• Main speaker: Geoffrey Huntley.
• Tools and projects discussed: Nix, NixOS-Test, Bazel, Buck2, Claude, Bombadil, Hegel, Hypothesis, and Playwright.
• Organization referenced: Antithesis, where Huntley says he works as a Field CTO.