AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair

2026-07-31

AI Summary

This work addresses the limitations of existing automated program repair techniques, which often underperform due to insufficient incorporation of multidimensional program context essential for real-world security practices. To overcome this, the authors propose a context-driven multi-agent framework that systematically integrates three complementary sources of contextual information—code structure, runtime execution traces, and commit history—through specialized sub-agents that collaboratively generate and inject contextual memory into a repair agent for conditional patch synthesis. The approach synergistically combines large language models with cross-file data-flow and memory analysis, crash semantics extraction, and version history mining. Evaluated on SEC-Bench, a benchmark of 300 real-world vulnerabilities, the method achieves a 73% repair success rate, outperforming the strongest baseline by 29%. Ablation studies further confirm the individual contributions of each contextual dimension and the efficacy of the multi-agent architecture.

Abstract

Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general bug repair - context that security engineers routinely assemble in practice but that existing agentic approaches do not engineer. We identify three critical gaps: code-structure context capturing cross-file data flows and memory operation patterns, runtime-execution context revealing crash semantics and memory origins, and commit-history context recovering how fragile code patterns were introduced. We present AgenticRepair, an agentic vulnerability repair framework that addresses the gaps through multi-faceted program context engineering. AgenticRepair orchestrates three specialized LLM subagents to engineer the contexts, which are then embedded into the memory of a dedicated repair subagent for context-conditioned patch synthesis. Evaluated on SEC-Bench comprising 300 real-world instances with sanitizer-based patch verification, AgenticRepair achieves a 73% success rate, substantially outperforming the strongest baseline by 29%. Our ablation study confirms that the three context facets are mutually complementary, and that multi-agent scaffolding and base-model capacity each play an essential role. Collectively, these findings establish multi-faceted program context engineering as a promising design direction for agentic vulnerability repair.

Problem

• vulnerability repair
• program context
• agentic AI
• automated program repair
• security flaws

Innovation

• agentic vulnerability repair
• program context engineering
• multi-agent LLM framework
• runtime-execution context
• commit-history context