Autonomous System Vulnerability Remediation: A Survey of Agentic AI, Reinforcement Learning, Benchmarks, and Operational Safety

Abstract Autonomous vulnerability remediation is moving from static playbooks and human-led patch queues to agents that can reason about system state, select defensive actions, make changes, and verify that risk has been reduced without operational failures. This survey reviews this emerging area for enterprise, cloud, network, container, and operating-system environments. We screened a corpus of 470 records using PICOS criteria that emphasized system-level vulnerabilities, LLM or agentic AI interventions, remediation execution, comparative or empirical outcomes, and publication quality. We also explored research on LLM-based infrastructure-as-code repair, autonomous cyber-defense benchmarks, agentic SOAR, reinforcement-learning patch optimization, and real-system remediation benchmarks. As this field is emerging the evidence base remains small, but it is coherent enough to survey. We organize the literature into six streams: LLM-based configuration and IaC remediation; autonomous cyber-defense agents in cyber ranges; reinforcement-learning vulnerability and patch management; agentic SOAR and self-healing operations; traditional patch automation and human practice; and benchmark infrastructure. Across these streams, five recurring themes define the field: state acquisition, policy and knowledge grounding, planning, guarded execution, and post-action verification. We then formalize autonomous system repair as a closed-loop task model that separates observation, diagnosis, action synthesis, safety gating, execution, verification, rollback, and evidence capture. The main research gaps lie in model capabilities, safety envelopes, rollback semantics, benchmark realism, service regression testing, evaluation comparability, and accountability for actions that change production systems.