PatchHolmes: Agentic Patch Retrieval via Listwise Selection
PatchHolmes uses listwise agent inspection to find vulnerability-fixing commits missing from CVE advisories.
PatchHolmes retrieves the commit that fixes a known vulnerability using a hybrid retriever and a listwise agent that inspects the top 100 candidates and reads 3 to 10 commits. The authors report that 60% to 63% of CVEs in major advisory databases lack a patch link. On GitHubAD it beat Favia by 25.34% Recall@1 and IRCoT by 31.40% with one agent conversation per CVE, and it runs locally on a frozen open-weight model without fine-tuning or external search APIs.
58