Automated Vulnerability Patching in Legacy Code Using LLMs and Multi-AI Agents

Abstract

This report synthesizes peer-reviewed and archival research published between 2019 and 2024 on the use of large language models and multi-agent architectures for automated vulnerability repair, with a specific focus on how these techniques apply, or fail to apply, to legacy software systems. The review traces a clear methodological progression across this five-year window: from template and heuristic program repair, through neural and transfer-learning models, to fine-tuned transformer-based repair, zero-shot and conversational prompting of general-purpose LLMs, and finally to multi-agent pipelines in which specialized agents divide the work of detecting, localizing, patching, and validating a vulnerability. Two figures accompany the discussion. The first depicts a generalized multi-agent repair pipeline synthesized from the architectures described across the reviewed literature, showing how detection, localization, patch generation, and validation agents typically interact, including the validation feedback loop that distinguishes conversational and agentic systems from earlier single-shot approaches. The second traces the field's methodological evolution chronologically, from 2019's template-based baselines through 2024's agentic systems. A comparative table consolidates fifteen of the most relevant studies discussed in the body of the report, listing the approach, target language, and publication venue for each. The report concludes that while multi-agent LLM pipelines show real promise for legacy code specifically, since their capacity for autonomous context reconstruction and iterative, feedback-driven refinement directly addresses the sparse documentation and thin test coverage that define legacy environments, the literature to date has been validated almost exclusively on actively maintained, comparatively well-organized open-source repositories. The gap between these benchmarks and the scale and disorganization of real enterprise legacy systems has not yet been closed empirically, and closing it, together with building trust and explainability mechanisms suitable for security-critical maintenance work, is identified as the field's most consequential open problem.