Trail of Bits与OpenAI合作推出两个AI Agent插件，用于自动化处理开源项目的安全问题。1其中patching-bugs插件能够再现报告的漏洞、开发修复方案并进行测试，1而regression-hunt插件则专门检查代码变更是否会破坏已有功能。1这两个插件基于Patch the Planet项目的经验设计，该项目此前与OpenAI合作为开源项目撰写了数百个安全补丁。1
在初步评估中，regression-hunt插件表现出明显优势。1相比基准Codex Agent方案，该插件的误报率降低了25%（95%置信区间为14%-38%）。1团队审查了130多个已合并的代码拉取请求，确认发现21个回归问题，其中包括16个功能性回归、1个性能回归和4个构建/测试相关回归，候选回归识别精度约36%。1
这些插件遵循四大设计原则：提供简洁明确的指导、采用模块化步骤、建立严格的输入输出规范，以及对每个声明都进行实时概念验证。1patching-bugs插件特别强调了三臂证明、不变量引导修复以及回归分析的融合。1
Trail of Bits and OpenAI have released two AI Agent plugins designed to streamline vulnerability remediation in open-source projects 1. The patching-bugs plugin automatically reproduces reported vulnerabilities, develops fixes, and runs tests to validate them, while the regression-hunt plugin detects whether code changes break existing functionality 1.
Both plugins draw from the Patch the Planet initiative, a collaboration between Trail of Bits and OpenAI that has produced hundreds of security patches for open-source software 1. The regression-hunt tool demonstrated a 25% reduction in false positives compared to a baseline Codex Agent approach, with a 95% confidence interval of 14% to 38% 1. In preliminary testing, the researchers reviewed over 130 merged pull requests and confirmed 21 regressions—16 functional, one performance-related, and four affecting build or test processes 1. The candidate regression identification accuracy stood at approximately 36%, with 21 confirmed regressions found among 58 candidates 1.
The plugins were built on four core design principles: clear and concise guidance, modular procedural steps, strict input-output patterns, and real-time proof-of-concept validation for each assertion 1. The patching-bugs plugin specifically emphasizes three-way verification, invariant-guided repair approaches, and integrated regression analysis 1.
评论
还没有评论，欢迎留下第一条。