Continuous fuzzing platforms such as OSS-Fuzz uncover large numbers of vulnerabilities, yet the subsequent repair process remains largely manual. Unfortunately, existing Automated Vulnerability Repair (AVR) techniques -- including recent LLM-based systems -- are not directly applicable to continuous fuzzing. This is because these systems are designed and evaluated on a static, single-run benchmark setting, making them ill-suited for the diverse, noisy, and failure-prone environments in continuous fuzzing. To address these issues, we introduce PatchIsland, a system for Continuous Vulnerability Repair (CVR) that tightly integrates with continuous fuzzing pipelines. PatchIsland employs an ensemble of diverse LLM agents. By leveraging multiple LLM agents, PatchIsland can cover a wider range of settings (e.g., different projects, bug types, and programming languages) and also improve operational robustness. In addition, PatchIsland utilizes a two-phase patch-based deduplication to mitigate duplicate crashes and patches, which can be problematic in continuous fuzzing. In our internal evaluation, PatchIsland repaired 84 of 92 vulnerabilities, demonstrating strong repair capability. In the official AIxCC competition, the system operated with no human intervention in a fully autonomous environment and successfully patched 31 out of 43 vulnerabilities, achieving a repair rate of 72.1\%.

翻译：诸如OSS-Fuzz等持续模糊测试平台能发现大量漏洞，但后续修复过程仍主要依赖人工。遗憾的是，现有自动化漏洞修复技术——包括近期基于大语言模型的系统——均无法直接适用于持续模糊测试场景。这是因为这些系统均基于静态、单次运行的基准测试环境设计与评估，难以适应持续模糊测试中多样化、高噪声且易失效的运行环境。为解决这些问题，我们提出了PatchIsland，这是一个与持续模糊测试流程深度集成的持续漏洞修复系统。PatchIsland采用由多样化LLM智能体组成的集成架构。通过协同多个LLM智能体，该系统能够覆盖更广泛的场景（例如不同项目、缺陷类型和编程语言），同时提升运行鲁棒性。此外，PatchIsland采用基于补丁的两阶段去重机制，以缓解持续模糊测试中常见的重复崩溃与重复补丁问题。在内部评估中，PatchIsland成功修复了92个漏洞中的84个，展现出强大的修复能力。在官方AIxCC竞赛中，该系统在完全自主的无人工干预环境下运行，成功修复了43个漏洞中的31个，修复率达到72.1\%。