1 of 8

PatchPilot AI

AGENTX HACKATHON 2026

Six AI agents check code you didn't write for security threats and bugs, prove each problem with real tools, fix it on a copy and verify the fix, for developers, students and small teams.

Team Tech_X · D02E86

Members Chinmay Jandrapalli · Shreyash Shigwan

Track PS-07 · Open Track

Intelligent Software Security & Code Verification

Detect Risks. Fix Bugs. Verify Code.

Live demo patch-pilot-ai-kohl.vercel.app Code github.com/chinmay1512f/PatchPilot-AI

2 of 8

The problem

2

01

Developers run and merge code they didn't write: GitHub projects, third-party repositories, coding assignments, AI-generated fixes.

1 Software Security

Untrusted code can hide malicious behaviour, vulnerabilities, exposed credentials and vulnerable dependencies.
Scanner findings still need manual investigation to understand their real impact.

→ data theft · financial loss · system compromise

2 Unverified Code Changes

Hidden bugs and their root causes are hard to find and prove.
An AI-generated fix can look right yet introduce new bugs or security vulnerabilities.

→ broken features · regressions · new vulnerabilities

Real-world example: WaterPlum [1]

Fake recruiters sent developers “coding tests” that installed malware when run.

Campaign-wide totals, Dec 2025 – Jul 2026.

30,000+

devices infected

7,000+

crypto wallets hit

¥1.7B+

stolen (≈ US$10.71M)

The missing piece: one workflow that finds threats, proves bugs with real tests, repairs the code and independently verifies every change before it is trusted or merged. That is PatchPilot AI.

[1] Joint cybersecurity advisory on WaterPlum (Japan NPA & NCO, FBI, DC3, ACSC, BND, BfV), Sept 2026, cyber.gov.au/advisory/north-korean-waterplum-…

Developers constantly run and merge code they didn't write: GitHub projects, third-party repositories, coding assignments and fixes generated by AI assistants. That creates two problems of equal weight. One, software security: untrusted code can hide malicious behaviour, vulnerabilities, exposed credentials and vulnerable dependencies, and even when a scanner flags something, someone still has to investigate what it really means. The cost is data theft, financial loss and compromised systems. Two, unverified code changes: hidden bugs and their root causes are hard to find and prove, and an AI-generated fix can look right yet introduce new bugs or vulnerabilities. The real-world proof of the security risk is WaterPlum, the 'Contagious Interview' campaign: fake recruiters sent developers coding tests that installed malware when run. A September 2026 joint advisory from Japan, the US, Australia and Germany counts at least 30,000 infected devices, over 7,000 crypto wallets and at least 1.7 billion yen, about US$10.71 million, stolen between December 2025 and July 2026. The missing piece is one workflow that finds threats, proves bugs with real tests, repairs the code and independently verifies every change before it is trusted or merged. That is PatchPilot AI.

3 of 8

What we built

3

02

1

Security analysis & attack paths

Finds malicious code, vulnerabilities, exposed secrets and vulnerable packages, and shows how they chain into an attack.

2

Proven bug repair

Finds a bug's root cause, proves it with a failing test, then writes a minimal fix on a copy.

3

Verified, evidence-based results

Every fix re-tested and re-scanned; risk score from a fixed formula; report and patch to download.

Real run: Insecure Notes full analysis · 8 / 8 roadmap steps · six agents · est. $2.19

4 of 8

Live demo

Open the app → New analysis → paste a GitHub link or pick a sample, and watch six agents fill the 8-step roadmap
Insecure Notes: “likely malicious” verdict, 76 findings, 3 attack paths, 3 verified security fixes
Buggy Shop: root cause found, proven by a failing test, 1-line fix, 15 / 15 tests pass, risk score 85 → 100
Download the evidence report and the patch: the original code is never modified

4

Live patch-pilot-ai-kohl.vercel.app Backup a recorded Buggy Shop run in replay mode; tests and scanners still run live

Demo script, about two minutes. Open the live app, choose New analysis and paste a GitHub link or pick a bundled sample. Start the Insecure Notes full analysis first and talk over it: the roadmap fills in as the six agents work, with the security lane in parallel. Show the malware verdict, likely malicious, the 76 findings, the three attack paths and the three security fixes the scanners no longer report. Then Buggy Shop: the agents find the root cause of the $50.00 shipping bug, prove it with a failing test, change one line on a copy, and all 15 tests pass; risk score 85 to 100. Finish by downloading the report and the patch. If the network fails, use the recorded Buggy Shop run in replay mode and say so out loud. Note: the free server sleeps after about 15 minutes, so open the link shortly before presenting.

5 of 8

How it works

5

04

Client

React web app on Vercel: paste a link, watch the live roadmap, read the report.

API

FastAPI server on Render (Docker image): jobs, usage limits, restricted test runs.

Brain

Central orchestrator + six Claude Opus 5.5 agents, using Bandit, Semgrep, OSV.dev and Pytest.

Data

SQLite job store; GitHub archive download; OSV.dev and npm / PyPI registries.

Hardest problem we solved: making AI results trustworthy

Claude never grades its own work. A bug counts only when a real test fails on it; a fix only when every test passes and the scanners re-run clean. The risk score is a fixed formula, not the model's opinion.

Sandbox: repository tests run with restricted execution, not a per-run container or VM. On the hosted demo they run as a separate low-privilege user with memory, process and time limits and no credentials in the environment. Network blocking is best-effort, so this is not a hard security boundary.

Inside the brain: the orchestrator runs six agents and passes checked results between them; agents never call each other.

1 Repository Understanding

2 Bug Investigation

3 Reproduction & Test

4 Repair

5 Verification & Security

6 Evidence & Reporting

Security lane, in parallel: scan → triage → attack paths → verified fixes

The real stack. Client: a React web app on Vercel. API: FastAPI on Render, in Docker, which handles jobs, usage limits and restricted test runs. Brain: our own central orchestrator and six agents on Claude Opus 5.5, using Bandit, Semgrep, OSV.dev and Pytest. Data: SQLite for jobs, GitHub's archive download for repositories, and the OSV.dev and npm/PyPI registries for package versions and known vulnerabilities. The six agents: repository understanding, bug investigation, reproduction and test, repair, verification and security, evidence and reporting, with the security lane running in parallel. The hardest problem was making AI results trustworthy. Claude never grades its own work: a bug only counts when a real test fails on it, a fix only when every test passes and the scanners re-run clean, and the risk score is a fixed formula. A failed fix gets one retry with the failure evidence; anything unproven is reported as inconclusive, never as a pass. On the sandbox, be precise: tests run with restricted execution, not a separate container or virtual machine per run. On the hosted demo they run as a separate low-privilege user with memory, process and time limits and no credentials in the environment; network blocking is best-effort. Docker is used only where it is installed. So it is a strong safeguard, not a hard security boundary.

6 of 8

Results

6

05

76

security findings in Insecure Notes, incl. a “likely malicious” verdict, 3 attack paths and 3 verified fixes

15 / 15

tests pass after PatchPilot's 1-line fix to Buggy Shop; risk score 85 → 100

< 1 min

Buggy Shop end to end: bug found, proven, fixed and verified (43–59 s, about $0.70–0.96 per run)

How we know it works

Real runs, stored with full logs. Insecure Notes and Buggy Shop as above; an over-broad AI patch reviewed (6 functions changed where the bug needed 1; the added requests package brings 4 known vulnerabilities); our own TechX_VEXORA project (102 lock-file packages, 10 known vulnerabilities incl. a critical Next.js one). PatchPilot itself has 142 passing automated tests.

Not done yet: tests run for Python projects only (Pytest); test runs use restricted execution with best-effort network blocking, not a per-run container or VM; a full analysis costs about $0.70–$4 in Claude API usage.

3 potential attack paths mapped

3 security fixes verified by re-scan

142 PatchPilot automated tests pass

Measured numbers only. Insecure Notes: 76 security findings, a likely-malicious verdict, three attack paths and three security fixes the scanners no longer report. Buggy Shop: after a one-line fix, 15 of 15 tests pass on the live demo and the risk score goes from 85 to 100. End to end, Buggy Shop takes under a minute: 43 to 59 seconds in our stored runs, about 70 to 96 cents each. How we know: every run is stored with full logs. We also reviewed an over-broad AI patch that changed six functions where the bug needed one and added a package with four known vulnerabilities, and analysed our own TechX_VEXORA project: 102 lock-file packages, ten known vulnerabilities including a critical Next.js one. PatchPilot has 142 passing automated tests. What doesn't work yet: tests only run for Python projects, test runs use restricted execution with best-effort network blocking rather than a container or VM per run, and a full analysis costs about 70 cents to 4 dollars in API usage.

7 of 8

What's next

7

06

1

Next month

JavaScript / TypeScript test runs (Jest, Vitest), so repair works beyond Python; review GitHub pull requests in one click.

2

In 3 months

Pilot with student developers and hackathon teams at our college; measure threats and bugs caught before merge.

3

In a year

Isolated containers per run and team dashboards; free for students, paid plans for teams to sustain it.

Our ask

A pilot partner (a development team or a college club), cloud credits for isolated sandboxes and Claude API usage, and mentorship from security engineers.

8 of 8

Team Tech_X

THANK YOU

Questions? Try it at patch-pilot-ai-kohl.vercel.app

GitHub github.com/chinmay1512f/PatchPilot-AI

Demo patch-pilot-ai-kohl.vercel.app

College St. John College of Engineering

Members Chinmay Jandrapalli · Shreyash Shigwan

PatchPilot AI – Detect Risks. Fix Bugs. Verify Code.