{ "schema_version": 1, "builder_plan": { "scenario": "Your coding assistant makes changes that still need substantial repair before merging.", "change": "Try the technique on held-out issues from a repository with reliable tests.", "baseline": "The same coding agent, repository snapshot, tools, and token budget.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Correct patches, regression failures, human repair time, and total cost per accepted change.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.20245", "title": "P2Patch: Exploit-Guided Vulnerability Repair", "summary": "P2Patch replaces single-pass vulnerability repair, where a patch is validated only against the evidence used to construct it, with an adversarial loop in which an exploitation agent generates new same-vulnerability exploits against each patched program and the final patch must block all accumulated proofs of vulnerability. The cost is multiple agent iterations per finding (exploitation plus patching per round) on third-party APIs, increasing token spend and end-to-end latency per CVE, plus infrastructure to run PoVs and maintain separate held-out evaluation oracles. It can fail when the exploitation agent cannot produce a working PoV for a vulnerability class, when accumulated repair requirements overfit to the generated exploits rather than the underlying flaw, and because absolute coverage gains are modest, the added cost may not pay off on low-severity findings.", "rationale": "The method runs entirely on third-party LLM APIs and fits constrained infrastructure, but its coverage gains are workload-dependent and its per-finding API cost requires validation on the reader's own vulnerability mix before production adoption.", "technique": "Adversarial exploit-guided iterative vulnerability repair", "family": "agentes_de_codigo", "recommendation": "testar", "published": "2026-10-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.20245", "independent_implementations": 0, "total_implementations": 0, "stars": 0, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "P2Patch replaces single-pass vulnerability repair, where a patch is validated only against the evidence used to construct it, with an adversarial loop in which an exploitation agent generates new same-vulnerability exploits against each patched program and the final patch must block all accumulated proofs of vulnerability. The cost is multiple agent iterations per finding (exploitation plus patching per round) on third-party APIs, increasing token spend and end-to-end latency per CVE, plus infrastructure to run PoVs and maintain separate held-out evaluation oracles. It can fail when the exploitation agent cannot produce a working PoV for a vulnerability class, when accumulated repair requirements overfit to the generated exploits rather than the underlying flaw, and because absolute coverage gains are modest, the added cost may not pay off on low-severity findings.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.20245", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Held-out fix-closed coverage rises from 78.1% to 84.7% and beyond-upstream coverage from 42.1% to 62.5% versus single-pass Claude Code repair; a distinct same-vulnerability exploit is found in 41% of runs after the original PoV is blocked.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.20245", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }