Trail of Bits open-sources AI plugins for automated bug patching and regression detection

Trail of Bits has published two open-source plugins, patching-bugs and regression-hunt, developed through its Patch the Planet initiative with OpenAI. The plugins structure AI agent workflows for reproducing bugs, developing fixes, and testing for regressions. In evaluations, regression-hunt produced 25% fewer false positives than a baseline Codex agent. The release follows Trail of Bits' review of 130+ merged PRs, which found 21 regressions introduced by their own AI-assisted patches.

How the plugins structure agentic patching

• patching-bugs reproduces reported bugs, develops fixes, and validates them with a "three-arm proof": original code fails, patched code passes, and full revert fails again
• regression-hunt traces changed code through callers to real interfaces, reproduces candidates on live deployments, and uses a fresh-context agent to judge results
• Both plugins use strict input/output schemas for every step, including claims, code revisions, required checks, raw evidence, and open questions
• regression-hunt incorporates threat models as global context for each agentic step when available
• patching-bugs mandates running regression-hunt as part of its standard pipeline
• Modular design allows skills to be used in tandem or isolation, not just end-to-end

Why it matters

The plugins address a growing concern in open-source security: AI-generated patches can introduce regressions. By open-sourcing tools that enforce structured evidence requirements and repeatable workflows, Trail of Bits aims to raise the signal-to-noise ratio in automated patching as vulnerability disclosure volumes increase.