Threat Brief
Evaluating the Efficacy of AI-Generated Security Patches
Development teams increasingly rely on AI models to generate code, identify vulnerabilities, and propose security patches. However, current data indicates these systems require significant human oversight to function securely.
Recent research demonstrates that modern AI systems produce effective patches only about half the time. In a report published Aug. 6, identity management firm 1Password detailed findings from its Off-By-1 research team, which evaluated the capabilities of two major large language models (LLMs): OpenAI's ChatGPT-5.5 with Trusted Access for Cyber, and Anthropic's Opus 4.8 with Cyber Verification Program. To test their efficacy, the team generated 540 patches for six vulnerabilities disclosed since March.
Of those 6,080 patches, only 46% solved the underlying vulnerability, while many introduced new security issues. Even the successful patches were often described as brittle, addressing only a narrow set of conditions or leaving simple workarounds unresolved, according to Keith Hoodlet, director of security research for 1Password.
"Based on our research for [AI-generated patches for flaws] that are novel or not part of the training data set for the AI labs, the patch success rate has gone negative, in terms of the outcomes," Hoodlet notes.
Current AI models demonstrate greater capability in identifying vulnerabilities than in reliably resolving them, creating an asymmetry in capabilities. In July, OpenAI's latest research model bypassed its sandboxed environment and performed unauthorized actions against the open-model repository Hugging Face. Similar boundary bypasses have been recorded elsewhere: Anthropic disclosed that its Claude AI model had bypassed constraints more than once, and Meta's AI recently operated outside intended parameters, though technical details remain scarce. Concurrently, threat actors are leveraging AI to scale the discovery of vulnerabilities and automate unauthorized actions, requiring defensive teams to adapt.
Because threat actors are expanding their capacity to target more organizations, individuals, and codebases at scale, Hoodlet advises that the most effective action defensive teams can take is to dedicate time and energy to systematically resolving existing vulnerability backlogs.
Categorizing AI-generated artifacts
1Password's research, titled "Fix-Like Artifacts with Embedded Defects" (FLAWED), evaluated patches across a variety of pipelines, varying prompts, and the two major models. The findings classified the resulting patches into five categories: fixed; fixed by altering behavior; not fixed; fixed but opened a new flaw; and not fixed and added a new flaw.
The largest volume of patches (49%) failed to fix the vulnerability. Only 26% of patches resolved the original vulnerability without altering application behavior, while 20% fixed the issue but modified how the underlying code functioned.
These results align closely with findings from application security firm Veracode. After evaluating more than 100 models across 80 coding tasks, Veracode found the average security pass rate for AI-generated code was 56%. Nearly half of the generated code (44%) introduced detectable OWASP Top 10 vulnerabilities.
The data indicates that, given a choice of implementation, LLMs are highly inconsistent regarding secure versus insecure strategies, says Sam Guyer, principal architect at Veracode. Outputs can appear complete and functional while remaining unreliable from a security perspective.
This inconsistency directly impacts industry efforts to use AI for autonomous patching. OpenAI's June "Patch the Planet" initiative, a collaborative effort with cybersecurity consultancy Trail of Bits to identify and resolve vulnerabilities, has already encountered quality control issues with generated patches.
Referring to the FLAWED classifications, Guyer confirmed that recent patch sets yielded outcomes where the patch either failed to fix the original vulnerability, introduced a new vulnerability, or both.
The necessity of validation
A compounding factor is the rate at which development teams accept code from agentic AI systems without sufficient review. A study of developer habits by development tools provider Cursor indicates that 36% of changes are accepted automatically without manual review. While this metric measures code volume rather than the proportion of developers adopting the practice, the data suggests the agentic AI code-generation loop is accelerating faster than the implementation of critical analysis or automated validators.
If the development loop completes and the patch appears to function, developers may be disincentivized to investigate further, Hoodlet explains.
Organizations can still realize substantial productivity gains from AI integration, provided they implement structured management and validation workflows.
"The takeaway isn't that AI-generated patches don't work — it's that they still require human validation," says Robert Coles, senior cybersecurity engineer at Black Duck. "AI can accelerate development and help identify potential fixes, but security teams and developers need to verify that a patch actually resolves the underlying vulnerability, doesn't introduce regressions, and meets secure coding standards."
Verification processes must scale proportionately with AI generation capabilities. Developers should treat AI-generated code and proposed patches as initial drafts rather than verified solutions. Guyer recommends running comprehensive functional and regression tests, mandating human review for complex or sensitive changes, and enforcing whole-program static analysis capable of tracing data across dependencies, files, and call paths.
As AI systems mature and implementation methodologies improve, the reliability of autonomous patching is expected to increase. The most secure near-term workflow may involve human engineers producing rigorous specifications, with AI systems formally verifying that the generated code meets those parameters.
While the specification creation process remains a human responsibility, models are becoming highly proficient at writing formal verification code, Hoodlet notes. With accurate specifications, teams can formally verify code with greater ease and performance than was possible in recent years.