A Google Security Engineering technical report describes an automated pipeline that reproduces sanitizer-detected bugs in C/C++, Java and Go, prompts an LLM for fixes, tests them, and surfaces the best candidate for human review. Google reports that Gemini fixed 15% of sanitizer bugs discovered during unit tests, resulting in hundreds of patches.
Why it matters
It is an early production-scale data point on LLM-generated security fixes with human review, a model later extended by CodeMender.
Key facts
As stated in the sources, with where to find them.
- Gemini successfully fixed 15% of sanitizer bugs discovered during unit tests, resulting in hundreds of bugs patched.Abstract
- The pipeline has five steps: find, isolate and reproduce, generate fixes with LLMs, test fixes, and surface the best fix for human review.Section 'An LLM-powered pipeline'
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
Sources
Related records
Oct 6, 2025
Sep 2, 2026
Apr 29, 2025
Aug 9, 2023
Aug 6, 2025
Jul 28, 2025