PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability Repair

2026-01-24

AI Summary

This work addresses the challenge that existing automated vulnerability repair (AVR) methods struggle to operate effectively in the dynamic, noisy, and error-prone environments of continuous fuzzing, limiting their ability to support ongoing repair demands. To overcome this, we propose a novel system for continuous vulnerability repair that integrates, for the first time, a multi-agent large language model (LLM) architecture with a two-stage patch deduplication mechanism, deeply embedded within continuous fuzzing platforms such as OSS-Fuzz. By leveraging diverse LLM agents that collaboratively generate and validate patches, our approach significantly enhances both repair coverage and robustness. Experimental results demonstrate that the system successfully repairs 84 out of 92 vulnerabilities in internal evaluation and achieves fully automated repair of 31 out of 43 bugs (72.1%) in the AIxCC competition, surpassing the limitations of traditional AVR approaches confined to static benchmarks.

Technology Category

• Planning, Routing, and Scheduling: Replanning and Plan Repair
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Abstract

Continuous fuzzing platforms such as OSS-Fuzz uncover large numbers of vulnerabilities, yet the subsequent repair process remains largely manual. Unfortunately, existing Automated Vulnerability Repair (AVR) techniques -- including recent LLM-based systems -- are not directly applicable to continuous fuzzing. This is because these systems are designed and evaluated on a static, single-run benchmark setting, making them ill-suited for the diverse, noisy, and failure-prone environments in continuous fuzzing. To address these issues, we introduce PatchIsland, a system for Continuous Vulnerability Repair (CVR) that tightly integrates with continuous fuzzing pipelines. PatchIsland employs an ensemble of diverse LLM agents. By leveraging multiple LLM agents, PatchIsland can cover a wider range of settings (e.g., different projects, bug types, and programming languages) and also improve operational robustness. In addition, PatchIsland utilizes a two-phase patch-based deduplication to mitigate duplicate crashes and patches, which can be problematic in continuous fuzzing. In our internal evaluation, PatchIsland repaired 84 of 92 vulnerabilities, demonstrating strong repair capability. In the official AIxCC competition, the system operated with no human intervention in a fully autonomous environment and successfully patched 31 out of 43 vulnerabilities, achieving a repair rate of 72.1\%.

Problem

• Continuous Vulnerability Repair
• Automated Vulnerability Repair
• LLM Agents
• Continuous Fuzzing
• Patch Deduplication

Innovation

• Continuous Vulnerability Repair
• LLM Agents
• Fuzzing Integration
• Patch Deduplication
• Autonomous Repair