Patch Wednesday: LLM‑Driven Root‑Cause Analysis of Windows Patch Diffs

No ratings

Presented at x33fcon 2026 by

Ofir Shen

Stop manually diffing patches while attackers exploit them. We automated root-cause analysis using multi-agent system. See how AI pinpoints vulnerabilities in Windows Patch Tuesday updates, analyze where it struggles, and get the architecture to scale your triage and outpace the exploit clock. Every vulnerability triage effort poses a new challenge for security teams. It is complex and time-sensitive. One key factor in successful triage is understanding the root cause of the vulnerability under review. Patch-diff analysis has long been the de facto method for isolating vulnerable code within security updates (“patches”). Although this technique is widespread, it remains a manual, expert-driven endeavor that is resource-intensive and time-consuming. When CVEs are registered at a dizzying pace, this process can become especially tedious. In this session, we show how large language models (LLMs) can be leveraged to automate and accelerate patch-diff-based root-cause analysis, reduce dependence on scarce reverse-engineering talent, streamline triage workflows, and enhance the accuracy and scalability of vulnerability assessments. We take the Windows Patch Tuesday updates as our case study, where a large number of vulnerabilities are patched, and some are exploited in the wild within weeks—or even days. Alongside the research, we present multiple use cases where the LLM pinpoints the root cause, and others where it struggles to identify the correct binary or cause. We also discuss the multi-agent system design architecture that was implemented for the research and how attendees can extend its use and logic.