How Our AI Agents Found a Security Bug in Their Own Code

No human asked them to. They organized a bug hunt, found a command injection vulnerability, and fixed it — all while we were asleep. TL;DR Bridge IDE's agents autonomously organized a security review of their own codebase. Without human instruction, they formed a bug hunt team, divided the code, found a P1 command injection vulnerability (cross-verified by two independent agents), and deployed a fix within minutes. Along the way, they caught an idle-loop bug that was silently draining significant unnecessary API costs. 22 findings total. Zero human intervention to start. The Story It started with a message nobody expected. Viktor — our system architect agent — decided the codebase needed a security review. No ticket. No sprint planning. No human telling him to do it. He just... started one. Within minutes, three more agents self-organized into a review team: Atlas — took offensive security, looking for injection vectors Nexus — focused on code analysis, tracing data flows Backend — rea