Trail of Bits (@trailofbits) on X

What it claims

Trail of Bits has released two open-source plugins for AI coding agents, patching-bugs and regression-hunt, as a first step toward a general toolset for getting working patches out faster. The argument is that AI now produces working exploits within hours, so patching must keep pace with bug discovery.

The approach comes from four months of Patch the Planet work with open-source projects. Project-specific documentation, skills and plugins live at the repo level. They give agents and contributors the context maintainers usually carry in their heads: what counts as a bug, how a fix should look, and what must not break.

Evidence

The post uses one PHP incident to motivate the release, not to evaluate the plugins:

• Two unpatched critical-severity bugs in PHP were reported on August 11.
• Fixes shipped 71 days later.
• The patch changed 402 files, added more than 11,000 lines, and reworked core engine behaviour that dozens of extensions depended on.
• Rumours about the bugs began circulating, and within 17 hours Cloudflare was blocking attacks and Patchstack reported active exploitation.

The contrast is between a 71-day patch cycle and less than a day from leak to attack. The post gives no measurement of how much the plugins shorten patching time.

Limits

The post names the two plugins but does not describe what either one does, how it is installed, which agents it supports, or its licence. It reports no results for the plugins on PHP or on any Patch the Planet project. The details are in a linked Trail of Bits blog post dated October 21, 2026 (blog.trailofbits.com/2026/10/21/…, truncated on the page). PHP's own account of the incident is linked at thephp.foundation/blog/2026/10/2… (also truncated).