Trail of Bits publishes patching-bugs and regression-hunt plugins for coding agents

Security firm Trail of Bits published two plugins that let engineers hand patch development and regression checks to coding agents. The patching-bugs plugin reproduces a reported bug, writes a fix and tests it. The regression-hunt plugin checks whether a change breaks behavior that used to work. Both grew out of Patch the Planet, Trail of Bits' joint initiative with OpenAI, and draw on its engineers' Codex sessions.

Trail of Bits says:

• A review of the patches its engineers wrote and maintainers merged confirmed 21 regressions among more than 130 merged pull requests; none broke a security protection.
• In its preliminary evaluation, regression-hunt produced 25% fewer false-positive findings than a baseline Codex agent asked to "review the PR for regressions" (95% confidence interval 14% to 38%). The stricter evidence rules also left some known regressions classed as borderline rather than confirmed.
• Every step must be backed by a live proof of concept. patching-bugs checks that the original code fails, the patched code passes and a full revert fails again.
• The plugins work best when a project supplies a THREAT_MODEL.md and a PATCHING_GUIDELINES.md (or AGENTS.md).

These are Trail of Bits' own figures.