# Trail of Bits open-sources AI plugins for automated bug patching and regression detection

> **Key takeaway:** Trail of Bits released patching-bugs and regression-hunt, two open-source plugins that automate security patch development and regression testing using AI agents.

**Published:** 2026-10-21T15:00:00+00:00 
**Source:** Trail of Bits Engineering Blog 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/trail-of-bits-open-sources-ai-plugins-for-automated-bug-patc.html 

## Summary
Trail of Bits has published two open-source plugins, patching-bugs and regression-hunt, developed through its Patch the Planet initiative with OpenAI. The plugins structure AI agent workflows for reproducing bugs, developing fixes, and testing for regressions. In evaluations, regression-hunt produced 25% fewer false positives than a baseline Codex agent. The release follows Trail of Bits' review of 130+ merged PRs, which found 21 regressions introduced by their own AI-assisted patches.

## How the plugins structure agentic patching
- **patching-bugs** reproduces reported bugs, develops fixes, and validates them with a "three-arm proof": original code fails, patched code passes, and full revert fails again
- **regression-hunt** traces changed code through callers to real interfaces, reproduces candidates on live deployments, and uses a fresh-context agent to judge results
- Both plugins use strict input/output schemas for every step, including claims, code revisions, required checks, raw evidence, and open questions
- regression-hunt incorporates threat models as global context for each agentic step when available
- patching-bugs mandates running regression-hunt as part of its standard pipeline
- Modular design allows skills to be used in tandem or isolation, not just end-to-end

## Why it matters
The plugins address a growing concern in open-source security: AI-generated patches can introduce regressions. By open-sourcing tools that enforce structured evidence requirements and repeatable workflows, Trail of Bits aims to raise the signal-to-noise ratio in automated patching as vulnerability disclosure volumes increase.