Note
The original research repository is located at osf.io/8k2ac and PatchAgent-Artifact. This repository is a production-focused fork dedicated to real-world bug fixing.
- 🎉 [2025.11] PatchAgent win 🥈 Runner-up in Technical Impact Award of CSAW Applied Research Competition (ARC) 2025!
- 🎉 [2025.10] PatchAgent is accepted at CSAW Applied Research Competition (ARC) 2025!
- 🎉 [2025.08] PatchAgent is presented at USENIX Security 2025!
PatchAgent is an LLM-based program repair agent that mimics human expertise to automatically generate patches for real-world bugs. It integrates:
- Language Server Protocol: For accurate code navigation and analysis
- Patch Verification: For ensuring correct and safe fixes
- Interaction Optimization: To achieve human-like reasoning during vulnerability repair
- Python 3.12+
- Docker (for OSS-Fuzz integration)
- Git
# Pull the image
docker pull ghcr.io/cla7aye15i4nd/patchagent:latest
# Run the container
docker run -it --privileged ghcr.io/cla7aye15i4nd/patchagent:latestCreate a .env file based on the template:
cp .env.template .env
# Edit .env with your API keys and configurationPatchAgent can be used to repair real-world bugs. Here's a simple example:
frompatchagent.agent.generatorimportagent_generatorfrompatchagent.builderimportOSSFuzzBuilder, OSSFuzzPoCfrompatchagent.parser.sanitizerimportSanitizerfrompatchagent.taskimportPatchTask# Initialize the repair taskpatchtask=PatchTask(
[OSSFuzzPoC("poc.bin", "libpng_read_fuzzer")], # Proof of Concept file with targetOSSFuzzBuilder(
"libpng", # Project name"/path/to/libpng", # Source code path"/path/to/oss-fuzz", # OSS-Fuzz path
[Sanitizer.AddressSanitizer], # Sanitizer to use
),
)
# Initialize and run the repair processpatchtask.initialize()
patch=patchtask.repair(agent_generator())
print(f"Generated patch: {patch}")For development, we recommend using the VS Code devcontainer:
- Install the VS Code Remote Development Extension
- Open the repository in VS Code
- When prompted, click "Reopen in Container"
This will set up a fully configured development environment with all the necessary tools.
- C/C++
- Java
- AddressSanitizer (ASan)
- MemorySanitizer (MSan)
- UndefinedBehaviorSanitizer (UBSan)
- ThreadSanitizer (TSan)
- Jazzer (Java fuzzing)
Below is a sample of the vulnerabilities fixed by PatchAgent. More will be disclosed as responsible disclosure periods end.
| Repository | Stars | Vulnerabilities |
|---|---|---|
| assimp | 11.4k | #5763, #5764, #5765 |
| libssh2 | 1.4k | #1508 |
| hdf5 | 0.6k | #5201, #5210 |
| libredwg | 1.0k | #1061 |
| Pcap++ | 2.8k | #1678, #1680, #1699 |
| yasm | 1.4k | #241, #242, #243, #244, #263 |
| gtp5g | 76 | #166 |
| Linux | oo | cafc66, 856db3, 6d1dc8, 9e7021, 026f65, 47f79b, 29372f, 9f16d9, 84faa9, f51424, e1dccb, e55ac3, 820ba7, e31fa6, 4dd1dd, 0784c6 |
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
For questions, bugs, or feature requests:
- Create GitHub issues
- For direct communication related to PatchAgent, contact Zheng Yu
To cite PatchAgent in scientific publications, please use:
@inproceedings{PatchAgent,
title = {PatchAgent: A Practical Program Repair Agent Mimicking Human Expertise},
author = {Yu, Zheng and Guo, Ziyi and Wu, Yuhang and Yu, Jiahao and Xu, Meng and Mu, Dongliang and Chen, Yan and Xing, Xinyu},
booktitle = {34rd USENIX Security Symposium (USENIX Security 25)},
year = {2025}
}