Agentic AI
Self-Learning AI Agent Pushes Automated Code Vulnerability Repair to 93% Success Rate
A new framework enables language models to improve at finding and fixing security bugs by building on past repair experiences rather than starting from scratch each time.
Large language models show real promise for automatically identifying and patching software vulnerabilities—yet they struggle with a fundamental problem: they don't learn from past repairs, leading them to make similar mistakes repeatedly and waste valuable knowledge about what works.
Researchers have now introduced EvoRepair, a new framework designed to let AI agents accumulate and reuse repair expertise across multiple security fixes. The system cycles through learning phases where it pulls insights from previous repair attempts, then applies that growing knowledge bank to tackle new vulnerabilities.
How the System Works#
EvoRepair operates on a continuous loop: when facing a new vulnerability, it first retrieves relevant experiences from its accumulated knowledge base to guide the repair attempt. After completing a repair trajectory, the system extracts lessons from that attempt and scores them based on quality. High-value insights get stored in an updated experience bank, creating a reservoir of domain-specific repair strategies that grows smarter over time.
Measured Impact#
When tested against 12 competing baseline approaches on standard vulnerability repair benchmarks (PATCHEVAL and SEC-bench), EvoRepair demonstrated substantial gains:
- 93.47% success rate on PATCHEVAL
- 87.00% success rate on SEC-bench
- 90.46% combined overall performance
The improvements over existing LLM-based methods proved striking: EvoRepair outperformed LoopRepair by roughly 40 and 33 percentage points on the two benchmarks respectively, and exceeded IntentFix by over 70 and 50 points. Even compared to Live-SWE-Agent, a recent self-evolving competitor, EvoRepair showed a 7-point advantage overall.
Broader Validation#
Additional experiments on VUL4J, a separate vulnerability dataset, confirmed that the approach generalizes across different models, programming languages, and evaluation sets, suggesting the method's robustness beyond its initial testing ground.
