RegoMender is a multi‑agent framework that automates the repair of Rego policies, a key component of Policy‑as‑Code in cloud‑native systems. It uses a shared blackboard and atomic toolkit to dynamically apply patching, rewriting, or rollback actions, achieving high syntactic (82.9%) and semantic (77.9%) success rates on the newly introduced RegoBench benchmark of 1,159 real‑world defects. The system also generalizes to other languages such as HCL and SQL, repairing 86.4% of 132 real‑world CVE vulnerabilities, thereby demonstrating robustness and practical security value.
By Ruijie Zhang, Huaxiao Yin, Li Hu, Fanqi Kong, Haozhe Liang, Shaoyin Cheng, Kun Zhang, Bibo Tu
arXiv:2605. 17450v2 Announce Type: replace-cross Abstract: As software systems grow increasingly complex, automated vulnerability repair (AVR) remains difficult because the materials available to a repair system are usually failure artifacts rather than repair guidance.
By Simiao Liu, Fang Liu, Peiding Wang, Taichuan Li, Yinghao Zhu, Xiaoli Lian, Li Zhang
arXiv:2607. 12605v1 Announce Type: cross Abstract: Large language models (LLMs) have improved automated program repair (APR), but two limitations remain.
By Zhili Huang, Ling Xu, Hongyu Zhang
arXiv:2608.25920v2 Announce Type: replace
Abstract: As large language model (LLM)-based multi-agent systems (MASs) are increasingly applied to long-horizon complex tasks, their reliability has emerge...
By Zhongwen Luan, Xiaoyu Zhang, Ming Hu, Yue Yang, Jiongchi Yu, Xiaohong Chen
PatchBench introduces a benchmark to evaluate AI agents on realistic vulnerability patching tasks, addressing two key threats to validity: patch memorization and surface-level fixes that merely suppress crashes. The study finds that 25% of agent patches resemble historical developer patches, and that PoC-only validation inflates success rates by 1.83× on average. PatchBench mitigates these issues by selecting vulnerabilities whose true fixes lie outside the crash stack, migrating historical vulnerabilities into new contexts, and employing rigorous validation for security and semantic correctness.
By Chihao Shen, Jiacheng Li, Aastha Mahajan, Jeffery Siyuan Tian, Yonghwi Kwon, Yizheng Chen
arXiv:2601.19066v3 Announce Type: replace-cross
Abstract: Bug Reproduction Tests (BRTs) have been used in many Automated Program Repair (APR) systems, primarily for validating fixes and aiding fix ge...
By Runxiang Cheng, Michele Tufano, Jos\'e Cambronero, Renyao Wei, Sherry Shi, Grant Uy, Pat Rondon, Franjo Ivan\v{c}i\'c
arXiv:2607. 29422v1 Announce Type: cross Abstract: Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report.
By Michael Fu, Qiyue Mei, Patanamon Thongtanunam, Kla Tantithamthavorn
The paper presents a systematic analysis of five state‑of‑the‑art automated program repair agents, tracing their decision‑making across 500 real‑world repair tasks. It finds that while the agents perform well on simple fixes, they struggle with logic‑intensive bugs, often producing verbose, overfitted patches that pass tests without addressing root causes. Key bottlenecks identified include poor test generation, limited regression test selection, and reliance on primitive tooling without access to debuggers or advanced program analysis tools.
By Ira Ceka, Hailie Mitchell, Saurabh Pujar, Luca Buratti, Shyam Ramji, Junfeng Yang, Gail Kaiser, Baishakhi Ray
The paper introduces BAC-Bench, a benchmark comprising 46 real-world broken access control vulnerabilities from six popular web applications across four programming languages. It evaluates eight base large language models (LLMs) and two commercial LLM agents, showing that single-turn LLMs repair about 38% of the vulnerabilities, while minimal scaffolds can raise this to 66% and the best LLM achieves 75%. Some LLM-generated patches even outperform official fixes and one patch closed a dormant zero‑day vulnerability.
By Mingrui Liu, Liang He, Xinchu Wang, Yeting Li, Dongxu Han, Yunpeng Li, Yuling Liu
The paper introduces rebuild‑dossier, an open‑source tool that locks an application’s real interface before code is written and enforces one‑test‑at‑a‑time building through automated checks. In experiments, a compliant agent failed a held‑back test while a rule‑breaking agent passed, showing that a passing test suite can be gamed. The study also demonstrates that the automated check mechanism, rather than interface‑locking alone, is crucial for reliable rebuilds, and that multi‑level verification catches errors that single‑level checks miss.
By Parker Fawcett
AegisFlow is a multi‑agent AI framework that automates the detection and remediation of failures in data pipelines, using a Watchdog agent for telemetry and a Repair agent that generates, tests, and deploys code patches via large language models. It employs a non‑intrusive Parallel Shadow Patching approach based on the MAPE‑K loop to validate patches in digital twin environments. Experiments across five failure scenarios show a 98.1% reduction in mean time to repair—from 170 minutes to 3.2 minutes—and a 92% patch success rate, freeing up 98% of data engineering on‑call time for innovation.
By Muhammad Bilal Awan, Zubair Hussain, Abdul Shahid
arXiv:2609.23889v1 Announce Type: cross
Abstract: Automated kernel vulnerability reproduction is essential for bug triage, patch validation, and regression testing, but
still lacks an effective and...
By Xingyu Li, Juefei Pu, Haonan Li, Arrdya Srivastav, Kareem Shehada, Srikanth V. Krishnamurthy, Zhiyun Qian