Unified AI Security Orchestrator: From Single-Purpose CVE Agent to Multi-Workflow Autonomous Platform

trm · Tech · 2026 · source Agentic: yes · promotional bias: low · source-backed · extracted with prompt 0.5.6 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Autonomous security operations

TRM Labs needed to evolve a narrow CVE patching agent into a unified AI security orchestrator that could triage, remediate, approve, and escalate multiple security workflows safely across infrastructure.

Constraints:

• The original agent handled CVE remediation across 150+ repositories but did not generalize.
• Security workflows needed strict authorization and escalation boundaries.
• The system had to operate inside Slack across multiple workflows.
• It needed production SLAs, instrumentation, staging, and safe rollout.
• The full tool surface included 56 tools, too many to expose on every task.

Architecture

TRM rebuilt the CVE patch agent into a Slack-native orchestrator-workers platform. Claude Opus acts as a central dispatcher in a Cloud Run service, selecting among 14 skills and context-specific subsets of 56 tools. The platform handles alert triage, PR review, helpdesk requests, and vulnerability remediation with per-workflow SLAs, OpenTelemetry instrumentation, staging/prod channel ownership, and a knowledge flywheel.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  slack_event_interface["Slack event interface"] --> pub_sub_fanout["Pub/Sub fanout"]
  pub_sub_fanout --> cloud_run_orchestrator_service["Cloud Run orchestrator service"]
  channel_ownership_config["Channel ownership config"] --> cloud_run_orchestrator_service
  cloud_run_orchestrator_service --> claude_opus_orchestrator["Claude Opus orchestrator"]
  claude_opus_orchestrator --> skill_registry["Skill registry"]
  skill_registry --> tool_registry["Tool registry"]
  tool_registry --> github_and_security_systems["GitHub and security systems"]
  claude_opus_orchestrator --> brain_knowledge_system["Brain knowledge system"]
  open_telemetry_instrumentation["OpenTelemetry instrumentation"] --> cloud_run_orchestrator_service

Components

Data flow

Slack events enter a public load balancer, are HMAC-verified, fan out through Pub/Sub to staging and production Cloud Run services, and are accepted or dropped based on YAML channel ownership. For accepted events, Claude Opus selects a workflow skill and a narrowed tool subset, investigates, diagnoses, fixes or escalates, records observations, and emits outcomes back to Slack or GitHub/security systems.

Why this architecture

TRM recognized that security workflows share the same alert-investigate-diagnose-fix-close loop, so a single orchestrator with skill/tool specialization could compound learning across workflows instead of duplicating automation.

Models used: Claude Opus · Claude Code

Scale

• The original CVE agent worked across 150+ repositories.
  “The original system automated CVE remediation across 150+ repositories using reinforcement learning”summary, stated
• The orchestrator exposes 14 skills and controls 56 tools.
  “The system exposes 14 user-invocable skills plus operational triage capabilities, controlling 56 tools in total.”summary, stated
• The platform processes about 10,000 interactions monthly.
  “The platform now processes approximately 10,000 interactions monthly”summary, stated
• It auto-closes 17% of security alerts.
  “auto-closes 17% of security alerts without human intervention”summary, stated
• It resolves 45% of helpdesk requests without tickets.
  “resolves 45% of helpdesk requests without creating tickets”summary, stated

Alternatives considered (roads not taken)

Keep separate agents per workflow

Rejected because: The shared five-step security pattern supported a unified orchestrator.

Expose all 56 tools to the model

Rejected because: Tool subsetting improves selection and authorization boundaries.

Replace the proven CVE patch worker

Rejected because: TRM preserved the Cloud Run and Claude Code worker loop as one skill.

Patterns

multi-agent-orchestration (security workflows)

Claude Opus dispatches skills and workers across remediation, triage, reviews, and helpdesk tasks.

tool-use-orchestration (security tools)

The orchestrator selects workflow-specific subsets from 56 available tools.

observability-tracing (production ops)

The service runs with comprehensive OpenTelemetry instrumentation and workflow SLAs.

agent-memory (knowledge flywheel)

The Brain knowledge system captures observations to improve future workflow handling.

safety-policy-enforcement (authorization)

Tool subsetting and escalation boundaries limit what the model can do per channel/workflow.

Tradeoffs

Use one orchestrator service.

Chose Unified Cloud Run orchestrator loop over Separate services for each security workflow.

Rationale: Common workflow shape and shared knowledge let improvements compound.

Fan out Slack events to staging and production.

Chose Shared Slack app, Firestore, secrets, and Pub/Sub fanout with channel ownership over Separate isolated Slack apps per environment.

Rationale: This enables realistic staging against real Slack and Firestore state without double-handling.

Gotchas (what bit them)

Specialized agents do not generalize without re-architecture.

Root cause: The V1 CVE agent was a function from CVE to PR.

Resolution: Preserve the patch worker as one skill inside a broader orchestrator platform.

Full tool surfaces degrade selection and security.

Root cause: A model seeing all 56 tools at once faces unnecessary choice and broader authority.

Resolution: Subset tools by Slack channel and workflow context.

Testing Slack-native agents can create double-handling risk.

Root cause: Staging and production services both receive the same Slack events.

Resolution: Use channel ownership config so non-owner services drop events quietly.

Evaluation

TRM evaluates the orchestrator through monthly interactions, alert auto-closure, helpdesk ticket avoidance, autonomous low-risk PR approvals, per-workflow SLAs, and instrumentation.

Metrics: 10,000 interactions monthly. · 17% security alert auto-close rate. · 45% helpdesk resolution without tickets. · 150+ repositories in the original CVE agent. · 14 skills and 56 tools.

Outcomes

• TRM evolved a CVE patching agent into a multi-workflow AI security orchestrator.
• The platform autonomously handles alert triage, PR reviews, helpdesk requests, and remediation.
• The system runs as a production service with SLAs, OpenTelemetry, staging, and knowledge capture.

The orchestrator handles about 10,000 monthly interactions with 14 skills and 56 tools.