Two new plugins, patching-bugs and regression-hunt, let engineers delegate reproducing, fixing, and regression-checking to AI agents while keeping maintainers in control of security assumptions and patch rules. Patching-bugs reproduces reported bugs on live deployments, generates fixes guided by invariant-based repair, and validates them using a three-arm proof (original fails, patched passes, revert fails). Regression-hunt traces diffs to exposed interfaces, reproduces candidate regressions on fresh live contexts, and requires adjudicated, live proof-of-concept evidence before reporting. A review of over 130 merged PRs produced 21 confirmed regressions, and regression-hunt produced 25% fewer false positives than a baseline Codex agent, although stricter evidence requirements left some known regressions classified as borderline.
Design choices emphasize short, opinionated guidance; modular steps; strict input/output schemas that encode claims, revisions, checks, and raw evidence; and live PoC for every claim. Plugins incorporate project-specific THREAT_MODEL.md and PATCHING_GUIDELINES.md so agents follow local definitions of vulnerabilities and patching expectations. Planned work includes formal evaluations of patch correctness and regressions, trace analysis to see what agent steps get skipped, and making plugins more configurable to balance false positives and coverage. The goal is a repeatable, auditable pipeline that scales patching quality as AI accelerates bug discovery.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.