More than half of AI-generated patches are broken
Brief
As AI-generated code continues to be injected into all corners of the internet, concerns have risen about an expanding attack surface for malicious hackers to exploit.
Some have argued that the enhanced cybersecurity capabilities of large language models could serve as a check, finding and fixing vulnerabilities nearly as fast as they’re created.
But new research that tested the patching capabilities of two popular commercial models, OpenAI’s ChatGPT 5. 5 and Anthropic’s Claude Opus 4. 8, found that generative AI is more likely to create an exploitable patch or introduce entirely new bugs than close off a vulnerability.
Researchers at 1Password tested the models ability to patch six “high-impact, high-complexity” CVEs, including the “Copy Fail” vulnerability, a kernel flaw that can give an attacker root access to Linux cloud environments.