Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.

We need to deploy essential services at least twice, apply CVE ‘fixes’ to a subset of them, and have tooling to diff their outputs.

That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.

[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.