Trail of Bits releases patching-bugs and regression-hunt plugins for AI-driven security fixes

Trail of Bits published patching-bugs and regression-hunt plugins that allow engineers to delegate patch development and regression checking to AI agents.
regression-hunt produces 25% fewer false-positive findings than a baseline Codex agent, with a 95% confidence interval of 14% to 38%.
A review of over 130 merged PRs from the Patch the Planet initiative confirmed 21 regressions, including 16 functional, one performance, and four build/test issues.
The plugins rely on strict input/output schemas and require a live proof of concept for every claim to ensure evidence-based validation.

Design Principles

Opinionated guidance minimizes agent latitude by recording only specific judgments on what constitutes a good patch or real regression.
Modular steps allow skills to be used in isolation or tandem, while fixed schemas enable each step to verify the previous step's work.
Every conclusion depends on a live proof of concept against a running instance of the project, reached through real user interfaces.

regression-hunt enumerates candidate regressions by tracing code changes to real interfaces, then reproduces and replays them on a fresh-context agent.
patching-bugs uses a three-arm proof requiring the original code to fail, the patched code to pass, and a complete revert to fail again.
Invariant-guided repair focuses on fixing the underlying security invariant rather than just the specific bug instance.

Plugins require a THREAT_MODEL.md file to define assets, trust boundaries, and evidence requirements for valid bug reports.
A PATCHING_GUIDELINES.md or AGENTS.md file instructs agents on build processes, fix size, and regression test requirements.
Maintainers can supply project-specific security assumptions to ensure agents work within the project's established rules.