From Finding to Fixing: Reducing maintainer burden with automated patches

Since its launch in 2016, OSS-Fuzz has contributed significantly to making open-source secure by finding and reporting tens of thousands of bugs. But finding more vulnerabilities increases the security burden on maintainers: they need to maintain their fuzzing targets and develop fixes to realize the security benefit.

In 2023, we showed how AI models can write and improve fuzzing targets with less effort from maintainers. This helped OSS-Fuzz increase fuzzing coverage and find new vulnerabilities in critical software like OpenSSL.

Today, we are taking the next major step: combining the reliability and scale of OSS-Fuzz with CodeMender, Google DeepMind's advanced AI agent for automated code security. Now, instead of just reporting a security issue, OSS-Fuzz’s automated pipeline works to find the root cause, develop a fix, and deliver a high quality patch. These ready-made patches relieve maintainers from the burden of securing their projects, reducing risk exposure by decreasing the time to getting a viable fix deployed.

How it works: combining OSS-Fuzz with the power of CodeMender

Agentic code scanning has accelerated the discovery of new vulnerabilities, but also introduces new problems of scale and toil for maintainers. Purely agentic scanners often generate reports with a high rate of false positives, forcing developers to spend time to identify real issues and reproduce them. Furthermore, even if agentic scanners solved this false-positive problem, using frontier models to scan continuously across large repositories is too expensive for most projects to do themselves.

Traditional fuzzing, therefore, remains a vital part of a defense-in-depth strategy. OSS-Fuzz provides a free, automated mechanism to find and deliver validated security bugs to OSS maintainers at scale, with a near-zero false positive rate.

And now, on top of these validated findings, we’re adding CodeMender, an AI agent for code security developed by Google DeepMind. When OSS-Fuzz finds a vulnerability, the system feeds the crash details and source code context directly into CodeMender. The CodeMender agent analyzes the flaw, exploring multiple code paths and hypotheses in parallel to come up with the true root cause of the vulnerability before coming up with a comprehensive patch. In addition to this, CodeMender employs rigorous validation techniques to ensure that the patch does not break any functionality.

Ensuring quality

We know that open source maintainers are overwhelmed with AI submissions. Many in the community have experienced large volumes of AI-generated patches that bring net-negative value when accounting for the cost of triage and review. We also see that many developers have published specific AI-contribution policies to help them contain these costs.

We’re addressing these concerns by building a rigorous patch delivery process. We proactively check each repository's guidelines before engaging; for example, if your project restricts AI code, we honor that choice and withhold submissions entirely. We verify that each patch works, testing every fix in an isolated environment to prove that it compiles cleanly and successfully resolves the crash, while not regressing on any functionality tests. Finally, as a temporary measure during this beta phase, Google engineers personally review proposed patches to ensure they’re up to standard.

In this way, we ensure that maintainer time and attention is respected, and you will only ever see a proposed patch when we have high confidence that it is the right one.

Get started

Today, automated patches are available for C/C++ projects in which OSS-Fuzz detects memory safety vulnerabilities.

If your C/C++ project is already enrolled in OSS-Fuzz, you do not need to change your configuration to start receiving patches. The pipeline will automatically attach CodeMender-generated patches to eligible vulnerability reports when available. You can opt your project out of automated remediation at any time by updating your OSS-Fuzz configuration, and new projects can start fuzzing with OSS-Fuzz today using our standard onboarding workflow.

Recipients of private disclosures can provide insights and feedback to internal reviewers by collaborating through their preferred disclosure channels and the OSS Fuzz Buganizer Issue. For broader feedback, participants can also reach out through Github.