# Trail of Bits: two agent plugins that prove a patch and hunt regressions

> Trail of Bits published two agent plugins that refuse to report a finding without a live proof of concept.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Tool
- **Published by:** Trail of Bits
- **Disclosed:** 2026-10-21
- **Affects:** OpenAI Codex, AI coding agents
- **Research by:** Anish Naik, Marcelo Morales
- **Primary source:** https://blog.trailofbits.com/2026/10/21/your-ai-agent-fixed-the-bug-but-what-else-did-it-change/
- **Page:** https://theinjection.dev/items/trailofbits-patching-bugs-regression-hunt/

Trail of Bits released patching-bugs and regression-hunt, two open-source agent plugins that demand a live proof for every claim: one proves a fix against original, patched and reverted code, the other hunts regressions.

## What happened

Trail of Bits published patching-bugs and regression-hunt on October 21, 2026, in a post by Anish Naik and Marcelo Morales. Both plugins live in the trailofbits/skills repository under a CC-BY-SA-4.0 license, and both landed there on October 20. The write-up reports that reviewing more than 130 merged upstream pull requests surfaced 21 confirmed regressions: 16 functional, one performance and four build or test.

## How it works

patching-bugs reproduces a reported bug, develops a scoped fix, and then runs what Trail of Bits calls a three-arm proof: the same reproduction must fail on the original code, pass on the patched code, and fail again on a full revert. regression-hunt traces a diff through callers to real interfaces, reproduces candidate regressions on a live deployment, replays the proof of concept with a fresh-context agent, and puts an adjudication step between evidence and verdict. A step that cannot produce a live proof returns an inconclusive result rather than a finding.

## Who is affected

Teams that let coding agents write security patches are the audience. The plugins read a THREAT_MODEL.md defining assets, trust boundaries and supported configurations, plus a PATCHING_GUIDELINES.md or AGENTS.md covering build and test commands, fix size and fix placement. The post describes use inside Codex sessions and names no other supported agent.

## What to do

Install both plugins together, since patching-bugs requires regression-hunt for its final regression check, and add the threat model and patching guideline files the skills read at every step. The authors report that in preliminary tests against the 21 known regressions, regression-hunt produced 25% fewer false-positive findings than a baseline Codex prompt, with a 95% confidence interval of 14% to 38%.

## Quick facts

- **Covers:** Agent-written security patches and regression checks
- **License:** CC-BY-SA-4.0, in the trailofbits/skills repository
- **Published by:** Anish Naik and Marcelo Morales, Trail of Bits
- **Reported result:** 21 confirmed regressions from over 130 merged upstream pull requests
- **Requires:** Python 3.13 or later, run through uv

## Sources

1. [Trail of Bits Write-Up](https://blog.trailofbits.com/2026/10/21/your-ai-agent-fixed-the-bug-but-what-else-did-it-change/)
2. [patching-bugs Plugin](https://github.com/trailofbits/skills/tree/main/plugins/patching-bugs)
3. [regression-hunt Plugin](https://github.com/trailofbits/skills/tree/main/plugins/regression-hunt)