Security Firm Trail of Bits Releases AI Agent Plugins: Self-Test Claims 25% Drop in Regression False Positives
Trail of Bits launched two AI agent plugins for code patching and regression checks. Official self-tests show regression-hunt reduces false positives by 25% compared to a baseline model, while emphasizing real-time proof-of-concept as an evidence threshold.
US cybersecurity consulting firm Trail of Bits released two AI agent plugins named patching-bugs and regression-hunt on October 21, 2026. These tools aim to let engineers delegate patch development and regression checks to AI agents while retaining human review over results.
According to the Trail of Bits blog, the patching-bugs plugin reproduces reported bugs, develops fixes, and tests them; the regression-hunt plugin specifically checks whether code changes break previously working behavior. The plugins were built based on experience from hundreds of security patches developed under the company's "Patch the Planet" initiative with OpenAI.
In preliminary evaluations, Trail of Bits claims the regression-hunt plugin produced 25% fewer false-positive findings than a baseline Codex agent prompted to "review the PR for regressions" (95% confidence interval of 14% to 38%). This assessment was based on a review of over 130 merged PRs, where 21 regressions were confirmed.
Core design principles include strict structured input/output schemas and requiring every conclusion to depend on a live proof-of-concept (PoC) against a running deployment. If a step cannot produce a live PoC, its result is considered inconclusive. This mechanism aims to improve the signal-to-noise ratio but comes with a trade-off: fewer false positives mean some known regressions may be classified as borderline and not confidently reported.