Imagine you're a team of detectives arriving at a crime scene with no witnesses and a vague 911 call. One detective studies the physical evidence, another interviews neighbors, a third reconstructs the timeline. Nobody has the full picture, but when they pool their notes, the composite sketch is far better than any solo detective's guess. That's ExploreRepair: three LLM agents each explore a different dimension of a vulnerability — its classification, its trigger conditions, and its code-level mechanics — then two aggregation layers reconcile their findings into a patch, all without ever seeing a proof-of-vulnerability test. The committed claim: under realistic information constraints (no PoV test, possibly wrong CWE classification), a multi-agent exploration-then-aggregation pipeline produces correct patches at rates 16-25 percentage points above current single-agent SOTA. This matters because real-world vulnerability disclosure is messy — CVE entries are incomplete, PoV tests are often unavailable, and developers need to act on partial information. Most prior work assumes you have the test that triggers the bug. ExploreRepair explicitly does not. The architecture is straightforward multi-agent orchestration on top of frontier LLMs. Three 'exploration agents' each independently analyze the vulnerable code from a specific angle: one focuses on vulnerability type interpretation, another on exploitation mechanics, a third on repair strategy. Their outputs feed into two parallel aggregation paths — a Lesson Aggregator that synthesizes observations into repair guidance, and a Patch Aggregator that reconciles concrete code implementations — before a final Aggregator merges these into a single patch. The whole thing runs without benchmark feedback, meaning no test-time oracle guides the aggregation. On the ladder: ExploreRepair with DeepSeek-V4.1-Flash hits 71.6% on PatchEval, compared to EvoRepair's 46.2% — a 25.4 percentage point gap. On VulnLoc+, it reaches 62.9% versus LoopRepair's 45.8% (the no-PoV variant) — a 17.1 point gap. With GPT-5.6-Luna, the numbers are lower (39.6% and 51.4%) but still beat SOTA by 16.0 and 20.0 points respectively. These are meaningful margins, not noise. The interesting wrinkle: DeepSeek-V4.1-Flash dramatically outperforms GPT-5.6-Luna here, suggesting that the framework's effectiveness is highly model-dependent. Integrity is reasonable but not bulletproof. PatchEval and VulnLoc+ are established community benchmarks in vulnerability repair research, and the baselines (EvoRepair, LoopRepair) are current named SOTA systems. The comparison is fair: they specifically compare against LoopRepair's no-PoV variant, which is the honest apples-to-apples match. However, there's no independent replication, no pre-registration, and success rates of 40-72% still mean a significant fraction of vulnerabilities go unpatched. The paper doesn't address how many of the 'successful' patches introduce new issues or are semantically equivalent to existing fixes. The milestone question is about scaling from benchmark success to deployment. Today's numbers — 62-72% on curated benchmark sets — need to hold on real CVE streams with messier code, larger codebases, and adversarial edge cases. The practical threshold is probably 85%+ repair success on real-world disclosures before security teams trust automated patching in CI/CD pipelines. That's a 15-20 point gap from the best number here. The obvious experiment they didn't run: testing against an adversarial benchmark where vulnerability descriptions are deliberately misleading or incomplete beyond just missing the PoV test. Real-world CVE descriptions contain errors, ambiguities, and sometimes deliberate misdirection. My read is (a) — this would require constructing a new benchmark, which is expensive and outside the scope of a methods paper, but it's the experiment that would actually prove the 'information constraints' framing is robust rather than brittle to specific kinds of noise.
