AutoPatch: Multi-Agent Framework for Patching Real-World CVEs Generated by Outdated LLMs

Large Language Models (LLMs) have become increasingly important in software development, yet their fixed knowledge cutoff makes them prone to generating code vulnerable to CVEs disclosed after the cutoff date. Existing in-context learning–based approaches attempt to detect or patch such code without requiring fine-tuning, but they face two key limitations: (i) they primarily target simplified CWE patterns rather than real-world CVEs, and (ii) they require developers to manually identify vulnerable code locations when generating patches. In response, we present AutoPatch, a multi-agent framework for automatically detecting and patching vulnerabilities in LLM-generated code, with a particular focus on CVEs disclosed after the cutoff date. AutoPatch integrates Retrieval-Augmented Generation (RAG) with 75 high-severity CVEs across real-world systems (e.g., Linux kernel and Chrome). Using this database, a unified detection model that combines semantic and data-flow signals identifies vulnerable patterns in LLM-generated code that resemble those in the RAG database. Dedicated LLM agents equipped with structured Chain-of-Thought (CoT) reasoning then verify the detected vulnerabilities and generate secure patches. Our experiments with a total of 497 code snippets show that our detection model achieves 91.8% CVE detection accuracy, while AutoPatch attains a 90.3% F1-score in vulnerability verification and 94.1% accuracy in patching, providing over 50× cost efficiency compared to LLM fine-tuning approaches.