{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/trail-of-bits-patching-plugins-regression-review-2026/",
 "asOf": "2026-10-30",
 "id": "trail-of-bits-patching-plugins-regression-review-2026",
 "date": "2026-10-21",
 "datePrecision": "day",
 "title": "Trail of Bits releases patching and regression-review plugins after finding 21 regressions in merged patches",
 "lane": "defense",
 "kind": "tool-release",
 "summary": "Trail of Bits releases patching-bugs and regression-hunt, plugins developed through its Patch the Planet work with OpenAI. It reports 21 confirmed regressions among more than 130 merged pull requests and preliminary testing in which regression-hunt produced 25% fewer false-positive findings than a baseline Codex review. The comparison used those 21 regressions, and stricter evidence requirements also left some known regressions unconfirmed; patching-bugs itself had not yet received the planned evaluation.",
 "whyItMatters": "It adds maintainer-facing evidence about the reliability cost of AI-assisted security fixes and a measured, limited tradeoff between false positives and confirming real regressions.",
 "actors": [
  "trail-of-bits",
  "openai"
 ],
 "topics": [
  "vulnerability-repair",
  "eval-validity",
  "autonomous-defense"
 ],
 "atlas": [],
 "artifacts": [],
 "sources": [
  {
   "url": "https://blog.trailofbits.com/2026/10/21/your-ai-agent-fixed-the-bug-but-what-else-did-it-change/",
   "publisher": "Trail of Bits",
   "title": "Your AI agent fixed the bug, but what else did it change?",
   "date": "2026-10-21",
   "type": "primary",
   "accessed": "2026-10-22"
  }
 ],
 "keyFacts": [
  {
   "fact": "Trail of Bits says it reviewed every patch its engineers authored and maintainers merged upstream for this work, confirming 21 regressions from more than 130 merged pull requests: 16 functional, one performance, and four build/test. It says none broke a security protection. These counts concern its own Patch the Planet patches, not all AI-generated fixes.",
   "locator": "Standardizing the patching process"
  },
  {
   "fact": "A single review run proposed 58 candidate regressions, of which 21 were confirmed, approximately 36% precision. Agents reproduced candidates before and after the change and an engineer reviewed the results; repeated runs can propose different candidates.",
   "locator": "Standardizing the patching process"
  },
  {
   "fact": "Using the full set of 21 confirmed regressions, Trail of Bits compared regression-hunt with a baseline Codex agent asked to review a PR for regressions. It reports 25% fewer false-positive findings, with a 95% confidence interval of 14% to 38%. This is a relative reduction in false-positive findings, not a 25-percentage-point accuracy gain or a measured improvement in patch correctness.",
   "locator": "regression-hunt reduces false positive rates"
  },
  {
   "fact": "The plugin left some known regressions classified as borderline because it could not gather sufficient evidence to confirm them. Trail of Bits says fewer false positives therefore traded off against how many known regressions it could confidently report; the post does not supply an overall recall figure.",
   "locator": "regression-hunt reduces false positive rates"
  },
  {
   "fact": "The plugins require structured evidence, live reproduction and independent checks. Patching-bugs tests whether a reproduction fails before a fix, passes after it and fails again when the fix is reverted; regression-hunt separately replays evidence with a fresh-context agent. These are release workflow features, not independent performance validation.",
   "locator": "How we designed the plugins; patching-bugs streamlines best practices from thousands of agent sessions"
  },
  {
   "fact": "Trail of Bits says an evaluation of patching-bugs is being built to measure whether fixes repair the reported issue and variants without regressions. That evaluation is future work in the 2026-10-21 post.",
   "locator": "What's next for the plugins"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-075",
  "FID-076",
  "FID-088"
 ],
 "methods": [
  "automated-patching",
  "patch-verification"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-24",
 "revisions": []
}