Autonomous Security Patch Triage: How AI Agents Are Cutting CVE Response Time in 2026

def gather_cve_context(cve_id: str, affected_package: str) -> dict:
    return {
        "cve_details": fetch_nvd_details(cve_id),
        "exploit_available": check_exploit_db(cve_id),
        "is_internet_facing": check_ingress_exposure(affected_package),
        "actually_called_in_code": check_static_call_graph(affected_package),
        "affected_services": find_services_using_package(affected_package),
        "existing_mitigations": check_waf_rules_covering(cve_id),
    }

import anthropic
import json
 
client = anthropic.Anthropic()
 
TRIAGE_PROMPT = """Triage this CVE for real risk to our environment, not just CVSS score.
 
CVE: {cve_id}
CVSS score: {cvss_score}
Advisory summary: {advisory_summary}
 
Our environment context:
- Package actually called in our code paths: {actually_called}
- Affected service is internet-facing: {internet_facing}
- Public exploit code available: {exploit_available}
- Services affected: {affected_services}
- Existing WAF/mitigation coverage: {existing_mitigations}
 
Determine:
1. Real priority: URGENT (patch within 24h) | HIGH (patch this week) |
   LOW (patch in normal cycle) | INFORMATIONAL (not exploitable in our context)
2. Is this safe to auto-patch (dependency version bump only, no breaking
   changes expected) or does it need human review first?
3. One-sentence justification a security lead would accept without re-verifying
 
Respond with ONLY valid JSON:
{{"priority": "...", "safe_to_auto_patch": true/false, "justification": "..."}}"""
 
 
def triage_cve(cve_id: str, cvss_score: float, context: dict) -> dict:
    response = client.messages.create(
        model="claude-sonnet-5",
        max_tokens=400,
        messages=[{
            "role": "user",
            "content": TRIAGE_PROMPT.format(
                cve_id=cve_id, cvss_score=cvss_score,
                advisory_summary=context["cve_details"]["summary"],
                actually_called=context["actually_called_in_code"],
                internet_facing=context["is_internet_facing"],
                exploit_available=context["exploit_available"],
                affected_services=context["affected_services"],
                existing_mitigations=context["existing_mitigations"],
            )
        }]
    )
    text = response.content[0].text.strip()
    if text.startswith("```"):
        text = text.split("```")[1].replace("json", "", 1).strip()
    return json.loads(text)

AUTO_PATCH_RULES = {
    "allowed": ["patch version bump only (x.y.Z)", "no config schema change", "existing tests pass"],
    "never_auto_patch": ["major version bump", "auth/crypto libraries", "database drivers"],
}
 
 
def handle_triage_result(cve_id: str, package: str, triage: dict):
    if triage["priority"] == "INFORMATIONAL":
        log_and_close(cve_id, triage["justification"])
        return
 
    if triage["safe_to_auto_patch"] and package_type(package) not in AUTO_PATCH_RULES["never_auto_patch"]:
        pr = open_patch_pr(package, cve_id)
        if run_test_suite_against(pr):
            comment_pr(pr, f"Auto-patch for {cve_id}: {triage['justification']}")
        else:
            escalate_to_human(cve_id, "Auto-patch failed test suite — needs manual fix")
    else:
        escalate_to_human(cve_id, triage["justification"], priority=triage["priority"])