Shopify Engineering

Read more on our Eng Blog: shopify.engineering/fine-tuning-ag… Or if you’re in Rio, check out @Shopify’s booth at @iclr_conf to chat about it in person!

We reverse-engineered training data from thousands of merchant-created automations and fine-tuned Qwen3-32B into a tool-calling agent for Shopify Flow. Results: 2.2x faster, 68% cheaper The more interesting part: why we trained on Python instead of our own DSL, and what broke when benchmarks looked good but production didn't. ⬇️

Find the full 3-day schedule of our booth presentations here. ta-conference.myshopify.com/pages/shopify-…

Our SimGym Expo Talk is Saturday @ 12:45pm (room 201c) join the chat and find the recording (eventually!) here. iclr.cc/virtual/2026/e…

🇧🇷 Come talk shop with Shopify at ICLR 2026 in Rio starting Thursday! 🇧🇷 We're building ML that runs 10% of e-commerce — from LLM-powered agents to production retrieval systems and sim-to-real pipelines. Real problems, real scale. Redefining commerce intelligence. Stop by Booth #202 for deep dives on: ⚡️Sidekick — agentic merchant AI with MCP tools + multi-turn reasoning ⚡️ Commerce Foundation Model — cross-domain architecture for recs, search, catalog ⚡️ Global Catalog — multimodal LLMs, 10K+ categories, 40M inferences/day ⚡️ Search Rewriting — L1 retrieval + L2 LLM re-ranking at scale ⚡️ SimGym — sim-to-real agent training for storefronts (Expo Talk 📷) ⚡️ Tangle — the open source ml experimentation platform

The full story of the extension @davebcn87 & @tobi open-sourced is on our Eng Blog: shopify.engineering/autoresearch

Since we open-sourced pi-autoresearch, @Shopify teams have been running it on everything. Results so far: Unit tests: 300x faster React component mounting: 20% faster CI build time: 65% reduction Made pnpm run faster Autoresearch never stops trying things you'd never have time to try. Repo: github.com/davebcn87/pi-a…

.@fnthawar talks AI infrastructure, culture, and guardrails behind productivity gains with @bessemervp

Commerce data is inherently messy: inconsistent product images, descriptions in dozens of languages, millions of merchants all doing it differently. Most AI benchmarks don't capture that complexity. We partnered with @MLCommons to change that:

Insights that were once out of reach for smaller merchants are now available, fast. Full deep dive → shopify.engineering/simgym #GTC2026

SimGym now runs simulated shopping sessions by the hundreds of thousands daily—with a step-change in speed on Blackwell GPUs. We partnered with engineers from @NVIDIAAI and @vLLM_project to shape a new inference stack around real production traffic: custom FlashInfer kernels, speculative decoding, and async scheduling.

The results in production for a large GraphQL list query running breadth-first: 15x faster field-level execution, 6x less GC overhead, 4+ seconds off P50 end-to-end time. Here’s more: shopify.engineering/faster-breadth…

When we profiled large and slow GraphQL list queries at Shopify, we found I/O wasn't always the bottleneck. Frequently it was GraphQL’s conventional depth-first execution design. We tried executing breadth-first instead. It went… really well.

We're enhancing payouts for certain medium severity bugs as part of our continued commitment to our security researcher community. Our updated calculator creates a smoother progression across severity tiers, with select medium severity reports now receiving increased rewards that better reflect their value to our security program. Check out our new calculator: shopify.com/ca/bugbounty/c…

Want the details on what changed in our bug bounty calculator? Let's break it down 👇

We reworked how scope changes are scored. Scope changes are now evaluated through three separate impact metrics: Confidentiality, Integrity, and Availability, collectively called Subsequent System Impact. Instead of a single “scope change” score, we now measure the effect of a vulnerability that crosses authorization boundaries according to what it impacts. This provides a more precise assessment of downstream risk.

User Interaction scoring just got more nuanced. In addition to None, we now differentiate between Passive and Active interaction. Passive means normal user activity can trigger exploitation, while Active requires a conscious, deliberate action (such as clicking a link). This separation allows for more detailed scoring of how exploitable a vulnerability is in practice.

Attack complexity wasn't telling the whole story. Alone, it sometimes missed critical deployment details. Attack Requirements is a new metric that recognizes when a vulnerability depends on specific system conditions—like feature flags, certain account types, or unique configurations. By capturing these prerequisites, we can assess vulnerabilities more granularly and give clearer context to their real-world impact.

Two new metrics just dropped in our bug bounty calculator: Value Density and Automatable. Value Density measures the depth of impact—the amount of sensitive information or control gained from a single exploitation event. Automatable determines if an exploit can be reliably scripted across multiple targets. This helps us better capture the distinction between large, high-value bugs and those that scale broadly through automation.

How we built it & what we learned on the @Shopify Engineering Blog: shopify.engineering/generative-rec…

Our team built a generative recommender that reads the full buyer journey and predicts what comes next, based on billions of real commerce events, millions of products, and the infrastructure to learn from it in real time. Fast enough to serve at scale, nuanced enough to read between the clicks.