New AI Hunts Down Missing Fixes for 6 in 10 Security Flaws

Every year, security researchers catalog thousands of software flaws in public databases. Each entry is like a medical chart that names the disease but loses the prescription: the fix exists somewhere in the code's history, yet 60% to 63% of these flaw listings have no link to it. That gap costs security teams hours of manual digging — and every hour a flaw sits unfixed is an hour attackers can use it.

PatchHolmes, a new system from researchers at Illinois Institute of Technology and collaborators, tackles this in two steps. First, a search tool narrows thousands of code changes down to the 100 most likely fixes. Then an AI agent reads that whole list at once — rather than scoring each option in isolation — and inspects just 3 to 10 of them using four limited tools before naming its single best answer. That 'one look at the whole menu' approach is the key trick.

The results are striking. PatchHolmes beat an earlier AI classifier by 25% on how often the correct fix was ranked first, and a competing method by 31%. In one test it lifted accuracy from 24% to nearly 40%. Notably, it used one conversation per flaw instead of ten, ran entirely on a free, publicly available AI model (one whose recipe anyone can download), and worked from a local copy of the code — no internet searches, no costly retraining. Swapping in different AI models barely changed the results, meaning the improvement comes from the method, not the model.

The practical payoff: faster patching shortens the window hackers have to exploit known holes. Smaller companies without dedicated security teams stand to gain the most. The catch is that the system only finds fixes that already exist in the code history, and finding the fix is not the same as applying it — that still takes a human. The work was accepted at a peer-reviewed conference, which adds credibility, but real-world deployment at scale is still untested.