If It's Not Buggy, Don't Fix It: On the Dynamics of Iterative Bug-fixing with LLMs

2026-09-10

Authors: Xietao Wang-Lin, Anton Isopoussu, Louis Mahon

ArXiv: 2609.10123v1

PDF: Download PDF

Imagine you hand a code review assistant a program and ask, "Anything wrong here?" A good assistant would say "nope, looks fine" when the code is genuinely correct. This paper investigates what actually happens when you let large language models (LLMs) play that role on a loop — and the answer is unsettling.

The researchers ran a simple experiment: feed programs to several popular LLMs and repeatedly ask them to find and fix bugs. They tried this on programs that were already correct and on programs with real bugs. Two findings jump out:

Why does this happen? LLMs are trained to be helpful, and "helpful" in a bug-fixing prompt means producing a fix. They rarely have the confidence — or the incentive — to say "nothing to do here." So each iteration nudges the code somewhere, and those nudges accumulate. The paper calls out the long-term dynamics: even if a single round has modest error rates, iterating turns those errors into steady erosion.

The title captures the practical takeaway perfectly: if it's not buggy, don't fix it. That sounds obvious, but it's exactly the discipline that "agent-in-the-loop" tooling lacks by default. Automated repair pipelines that keep asking "any more bugs?" until the model shrugs will never shrug — the model will keep inventing things to change.

The authors' recommendation is straightforward: treat LLM bug-fixers as one-shot suggesters that require a real oracle (tests, human review, or a stronger verifier) to accept or reject each change, and be extremely wary of open-ended iterative loops. Confidence calibration — teaching models to say "no bug found" — is flagged as an important missing piece.

Why it matters: As LLM-powered auto-repair tools spread through code review pipelines, this study shows they can silently degrade healthy code faster than they heal broken code — a cautionary result for anyone deploying agentic bug-fixers without a solid verification gate.

All newsletters