Fixing Bugs with AI Precision

A practical program repair agent that mimics human expertise

Zheng Yu, Ziyi Guo, Yuhang Wu, Jiahao Yu,
Meng Xu, Dongliang Mu, Yan Chen, Xinyu Xing
USENIX Security 2025

Read Paper View Code
1 if (element == NULL) {
2 RETURN_NULL();
3 }
4 zval_ptr_dtor(&element->inf);
5 zval garbage;
6 ZVAL_COPY_VALUE(&garbage, &element->inf);
7 ZVAL_COPY(&element->inf, inf);
8 zval_ptr_dtor(&garbage);
9 }
92.13% Success Rate
178 Vulnerabilities Fixed
30 Programs Tested
9 Bug Types

Real-World Impact

Successfully fixing critical vulnerabilities in popular open-source projects

assimp

⭐ 11.4k stars

3D model loading library - Fixed heap overflow & null dereference vulnerabilities

PR #1678 PR #1680 PR #1699

libredwg

⭐ 1.0k stars

AutoCAD DWG file library - Fixed use-after-free vulnerability

PR #1061

HDF5

⭐ 0.6k stars

High-performance data format - Fixed heap overflow vulnerabilities

PR #5201 PR #5210

libssh2

⭐ 1.4k stars

SSH2 client library - Fixed critical security vulnerability

PR #1508

PcapPlusPlus

⭐ 2.8k stars

Network packet parsing library - Fixed multiple heap overflow vulnerabilities

PR #1678 PR #1680 PR #1699

How It Works

An end-to-end solution that mimics human debugging expertise

🔍

Intelligent Fault Localization

Uses Language Server Protocol to navigate code like a human developer, identifying vulnerable code patterns with precision

🤖

Context-Aware Patch Generation

Leverages advanced LLMs to generate patches that understand the surrounding code context and maintain consistency

✅

Automated Validation

Comprehensive testing ensures patches fix the vulnerability without breaking existing functionality

🔄

Iterative Refinement

Learns from counterexamples and failed attempts to continuously improve patch quality

🎯

High Success Rate

Achieves 92.13% success rate across 178 real-world vulnerabilities in 30 different programs

🚀

Production Ready

Patches have been successfully merged into major open-source projects protecting millions of users

Citation

If you use PatchAgent in your research, please cite our paper

@article{PatchAgent,
  title     = {PatchAgent: A Practical Program Repair Agent Mimicking Human Expertise},
  author    = {Yu, Zheng and Guo, Ziyi and Wu, Yuhang and Yu, Jiahao and 
               Xu, Meng and Mu, Dongliang and Chen, Yan and Xing, Xinyu},
  booktitle = {34rd USENIX Security Symposium (USENIX Security 25)},
  year      = {2025}
}