AI and ML
Left alone, autonomous fixes often fail to fully remediate flaws
AI models may not be that good at fixing security flaws. Researchers at 1Password’s Off-by-1 Labs analyzed security patches generated by two frontier models – ChatGPT 5.5 at “medium” effort and Claude Opus 4.8 at “high” effort – and found that autonomous patches cleanly fixed vulnerabilities only about a quarter of the time, while most of the remainder failed to fully remediate the flaw or introduced other problems.
Keith Hoodlet, director of security research at 1Password, argues in a blog post that the results show LLM-driven security remediation still needs human review.
“Across six recently disclosed CVEs, we produced 6,080 patches using two frontier, cyber-capable reasoning models,” Hoodlet said. “The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent.”
Of the AI-generated patches, 20.1 percent fixed the original issue but altered application behavior (eg, changing “allow list” logic to “deny list” logic). Some 2.3 percent of the patches fixed the issue while introducing new security issues. 49.3 percent of the patches failed to fix at least one existing exploit path. And 2.2 percent both failed to fix the vulnerability while introducing a new exploit path.
And among the patches in the first two categories (successful, clean; successful, changes app behavior), the researchers rated more than a third of the results fragile, meaning that while the adjusted code may have guarded against a particular vulnerability (eg, escaping particular input characters), the repair job didn’t address the underlying problem.
In their research paper [PDF], authors Axel Mierczuk, Spencer Michaels, and Keith Hoodlet propose the acronym FLAWED to represent automated LLM patches: Fix-Like Artifacts With Embedded Defects. Based on the generated patches, they conclude, “[T]he expected value of a fully LLM-generated, non-human-reviewed patch is a net-negative by a considerable margin.”
The value of LLM-generated patches depends upon initial patching guidance. The research team says that while both human developers and LLMs typically require some initial guidance to tackle a vulnerability, LLMs are more likely to be derailed when given incorrect advice.
When LLMs get correct guidance, their fix-success rate hits 65.0 percent compared to 50.4 percent when they get no guidance. And incorrect guidance dooms LLMs, dropping their fix-success rate down to about 15.2 percent.
Human devs, the authors argue, have a good chance of catching misleading information as they reason through vulnerable code.
The authors have released a patch evaluation harness under the name FLAWED that organizations can use to evaluate the effectiveness of their security fixes.
It’s clear from the paper why AI-generated patches might be appealing – considered in isolation, they’re inexpensive relative to human software engineers. The average successful, clean patch cost just $6.74 (a figure that includes the cost of failed attempts).
Nonetheless, the authors argue that the cost-benefit analysis needs to assess how much expert supervision will be required to make LLM-assisted patching useful.
“Based on our manual review of a representative sample of patches generated during our research, we suspect that, in a large number of cases, the cognitive load imposed by reviewing a mountain of mostly-incorrect, similar-yet-subtly-different LLM-generated vulnerability patches will likely result in engineers spending more effort than would be necessary to understand and patch vulnerabilities themselves using standard LLM-assisted coding techniques that keep the human operator in the driver’s seat,” the authors conclude.
“The alternative, cognitive surrender to a process with a success rate of only about 1 in 4 poses significant long-term risks for any organization considering autonomous, LLM-driven patching.” ®
