# PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability Repair

arXiv: https://arxiv.org/abs/2601.17471 · HTML: https://mlsanity.com/paper/2601.17471/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 7 of its 46 references that are in the map.
- First posted on arXiv 24 Jan 2026.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 7 of 7)

- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [RepairAgent: An Autonomous, LLM-Based Agent for Program Repair](https://mlsanity.com/paper/2403.17134/) (2024)
- [APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching](https://mlsanity.com/paper/2408.13597/) (2024)
- [SoK: Automated Vulnerability Repair: Methods, Tools, and Assessments](https://mlsanity.com/paper/2506.11697/) (2025)
- [Enhancing LLM Code Generation with Ensembles: A Similarity-Based Selection Approach](https://mlsanity.com/paper/2503.15838/) (2025)
- [Fixing Security Vulnerabilities with AI in OSS-Fuzz](https://mlsanity.com/paper/2411.03346/) (2024)
- [E-APR: Mapping the Effectiveness of Automated Program Repair](https://mlsanity.com/paper/2002.03968/) (2020)

## Built on by (most cited first, 2 of 2)

- [SoK: DARPA's AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned](https://mlsanity.com/paper/2602.07666/) (2026)
- [EvoRepair: Enhancing Vulnerability Repair Agents Through Experience-Based Self-Evolution](https://mlsanity.com/paper/2605.30105/) (2026)

## Abstract (arXiv)

Continuous fuzzing platforms such as OSS-Fuzz uncover large numbers of vulnerabilities, yet the subsequent repair process remains largely manual. Unfortunately, existing Automated Vulnerability Repair (AVR) techniques -- including recent LLM-based systems -- are not directly applicable to continuous fuzzing. This is because these systems are designed and evaluated on a static, single-run benchmark setting, making them ill-suited for the diverse, noisy, and failure-prone environments in continuous fuzzing. To address these issues, we introduce PatchIsland, a system for Continuous Vulnerability Repair (CVR) that tightly integrates with continuous fuzzing pipelines. PatchIsland employs an ensemble of diverse LLM agents. By leveraging multiple LLM agents, PatchIsland can cover a wider range of settings (e.g., different projects, bug types, and programming languages) and also improve operational robustness. In addition, PatchIsland utilizes a two-phase patch-based deduplication to mitigate duplicate crashes and patches, which can be problematic in continuous fuzzing. In our internal evaluation, PatchIsland repaired 84 of 92 vulnerabilities, demonstrating strong repair capability. In the official AIxCC competition, the system operated with no human intervention in a fully autonomous environment and successfully patched 31 out of 43 vulnerabilities, achieving a repair rate of 72.1%.