Of all the AI research dropping at Black Hat, BSidesSF and elsewhere at Hacker Summer Camp, one of the more interesting developments is this research from 1Password:
Keith Hoodlet, Director of Security Research at 1Password, said that as Trail of Bits' "Patch the Planet" initiative continues identifying and attempting to remediate vulnerabilities, Off-by-1 Labs wanted to understand how reliably frontier AI models can perform that remediation on their own.
What they found is that while AI dramatically accelerates vulnerability discovery, finding bugs is proving to be much easier than fixing them.
The research from 1Password's Off-by-1 Labs suggests the industry may be getting ahead of itself when it comes to AI-generated security patches. After generating and analyzing more than 6,000 patches across six recently disclosed, high-complexity vulnerabilities, researchers found that more than half failed to fully solve the problem they were intended to fix.
That doesn't mean AI isn't useful. It means we're still a long way from letting it patch production code without experienced security engineers looking over its shoulder.
More than half the patches were flawed
Off-by-1 Labs tested two of today's leading coding models—OpenAI's ChatGPT 5.5 and Anthropic's Claude Opus 4.8—against six recently disclosed open-source vulnerabilities, including Linux privilege escalation, Apache ActiveMQ remote code execution, Chrome's File System Access API, Spring AI, Exim, and Gemini CLI. The goal was deliberately difficult: determine whether frontier models could generate patches for vulnerabilities that were too new to have likely appeared in their training data.
The results are difficult to ignore:
- 53.9% of generated patches either failed to eliminate the original vulnerability, introduced a new vulnerability, or both.
- Only 26.0% completely remediated the vulnerability without changing application behavior.
- Another 20.1% successfully closed the vulnerability but altered how the software behaved, potentially creating operational problems even if security improved.
Those numbers came from 6,080 generated patches, with researchers intentionally removing runs where models attempted to locate the official upstream fix rather than solve the problem themselves.
Fixing the symptom isn't fixing the vulnerability
Perhaps the more interesting finding isn't the overall success rate. It's how the models failed.
Researchers found that many successful-looking patches simply blocked the proof-of-concept exploit rather than eliminating the underlying vulnerable code. In one example involving Spring AI, models frequently escaped specific malicious characters instead of addressing the root cause. That stopped the demonstrated exploit while leaving alternate attack paths intact.
The paper refers to these as Fix-Like Artifacts With Embedded Defects (FLAWED) — patches that appear correct at first glance but ultimately leave organizations exposed.
This isn't an argument against AI
The findings are an argument against overconfidence as everyone rushes AI into their processes.
The same frontier models that are rapidly improving vulnerability discovery still struggle to consistently produce production-ready remediations for complex flaws. Researchers note that today's bottleneck is increasingly verification rather than discovery — a point echoed by Anthropic during the study.
More from Hacker Summer Camp:
George V. Hulme
George V. Hulme
Bill Brenner
Bill Brenner
Human review remains the security control
Hoodlet said the conclusion is straightforward: AI-generated patches are not a substitute for expert review. Human engineers still need to verify that patches eliminate the root cause, preserve intended application behavior, and avoid introducing new vulnerabilities before they're deployed.
To help improve that process, Off-by-1 Labs is releasing the dataset and tooling used during the research so defenders can generate, validate, compare, and manually review AI-generated patches within their own environments.
The bigger picture
One of the cybersecurity industry's recurring habits is assuming AI will compress every stage of the software security lifecycle equally. This research suggests that's unlikely.
AI may dramatically accelerate vulnerability discovery. It may even produce useful first drafts of patches. But verification remains stubbornly human work, particularly when dealing with high-impact vulnerabilities where missing a single code path can leave systems exploitable.
That's not a weakness of AI so much as a reminder of the defender's reality: shipping code that merely looks secure has never been good enough. The latest generation of coding models simply makes that distinction easier to overlook.
