Automated tools improve software fixes with limited bug details
ExploreRepair: Evidence-Specialized Agents for Vulnerability Repair under Information Constraints
Software EngineeringCryptography and Security
Summary
Fixing software bugs that cause security problems can be hard when not all the details are known. The authors created a system called ExploreRepair that uses multiple specialized helpers to guess what the problem might be and suggest fixes. These helpers work together, combining their ideas to produce better repairs even without exact test cases. Their approach fixed more bugs than previous methods on standard tests.
What this means in practice
- •For software security teams: Automatically generate patches for security bugs when full vulnerability details or tests are not available.
- •For devops engineers: Integrate exploration agents to improve automated repair workflows under uncertain bug information.
Authors
Duc Manh Tran, Ratnadira Widyasari, Ivana Clairine Irsan, Huihui Huang, Ting Zhang, David Lo, Rahul Gopinath, Hong Jin Kang
Abstract
Automated vulnerability repair must often operate with incomplete vulnerability information: developers may lack an accurate vulnerability classification or a provided proof-of-vulnerability (PoV) test, yet still need to produce a repair. Without detailed information, a key challenge is to explore multiple plausible interpretations of the vulnerability before committing to a repair. To address this challenge, we propose ExploreRepair, a vulnerability repair framework that reconciles the vulnerability observations and repair implementations from a team of exploration agents. We first collect these observations and repair implementations from three agents, each tasked with exploring a specific dimension of the vulnerability. Then, a Lesson Aggregator and a Patch Aggregator independently synthesize repairs from these observations and concrete implementations before a final Aggregator reconciles their proposals without benchmark feedback. On PatchEval, ExploreRepair achieves repair success rates of 39.6% and 71.6% with GPT-5.6-Luna and DeepSeek-V4.1-Flash, respectively, exceeding EvoRepair, a state-of-the-art vulnerability repair approach, by 16.0 and 25.4 percentage points. On VulnLoc+, it achieves success rates of 51.4% and 62.9%, respectively, exceeding LoopRepair's variant without PoV tests by 20.0 and 17.1 percentage points.