BUGSTONE-E2E Turns CVE Patch Records Into Agent Skills, Generating Runtime Evidence for 644 Software Defects

CVE databases preserve vulnerability descriptions and links to patches, but security scanners generally do not directly reuse the program semantics revealed by patch commits. BUGSTONE-E2E attempts to turn these historical records into executable workflows: it extracts scanning anchors, remediation semantics, and CVE provenance from verified patch commits, then organizes them into rules by CWE and programming language. From 19,325 high-severity CVEs reported between 2022 and 2026, the research team identified 2,710 patch commits, generated 1,033 rules, and packaged them into 172 agent-usable skills.

At runtime, the system uses a funnel-shaped design to avoid handing an entire codebase to an expensive model at the outset. Tree-sitter first enumerates call sites matching API or syntax anchors, and lightweight heuristic rules filter out obviously safe cases. An LLM agent examines only the remaining candidates, after which they are triaged again, executable validations are created, and narrowly scoped patches are generated. Behavior is then verified through bidirectional differential testing before and after the patch. According to the paper, the system generated runtime evidence for 644 findings across 14 evaluated programs. Compared with simply asking a model to read vulnerability descriptions, this workflow connects provenance, localization, reproduction, and remediation into an auditable chain while concentrating large-model costs on difficult cases.

For teams maintaining large C/C++, Java, or mixed-language codebases, the key point is the portability of treating vulnerability history as a rule repository, rather than the performance of any single model. Before deployment, teams still need to measure the false-positive rate for each CWE, determine whether reproduction tests actually exercise the vulnerability, and check whether agent-generated tests and patches share the same mistaken assumptions. For now, the 644 results should be regarded only as candidate findings backed by runtime evidence; the paper has not yet provided independent reproduction, a fully public toolchain, or subsequent CVE validation. The next questions are whether the rules can generalize across versions and projects, and whether their real-world CI cost is lower than that of conventional manual analysis.