The Trail of Bits Blog

The Trail of Bits Blog is the research and engineering blog of Trail of Bits, a security firm known for work on software assurance, vulnerability research, and open-source security tooling. This article focuses on a practical question: when an AI agent fixes a bug, how do you know what else it changed? It introduces two plugins designed to make agent-assisted patching more reliable and reviewable.

The first plugin, patching-bugs, reproduces reported bugs, develops fixes, and tests them. The second, regression-hunt, checks whether changes break previously working and supported behavior. Both were built through Patch the Planet, a joint initiative with OpenAI that has produced hundreds of security patches for widely used open-source projects. Maintainers can supply their own security assumptions and patching requirements so agents work within project rules.

The post also discusses how regression-hunt reduces false positive rates and how patching-bugs streamlines best practices drawn from thousands of agent sessions. It is aimed at security engineers, open-source maintainers, and developers who want to delegate patch development and regression checks to agents without giving up oversight.

For readers new to agent-assisted security work, the article is best read as a design rationale rather than a step-by-step tutorial. It helps teams understand what to delegate, what to review, and why patching standards matter. Overall, it is a concise look at making AI patching workflows mo