As AI-generated code continues to flood the internet, concerns are growing about its potential vulnerabilities and flaws. A recent study by 1Password has revealed a startling fact: more than half of patches generated by popular commercial models, such as OpenAI’s ChatGPT 5.5 and Anthropic’s Claude Opus 4.8, are broken or introduce new bugs rather than fixing existing vulnerabilities.
Researchers at 1Password tested the patching capabilities of these two models on six high-impact, high-complexity CVEs (Common Vulnerabilities and Exposures), including a kernel flaw that can grant attackers root access to Linux cloud environments. The results were dismal: only 47% of the patches generated by the models successfully fixed the vulnerabilities without introducing new problems.
This is not an isolated finding. A separate study by Veracode, which tested 100 different language models, found similar issues with AI-generated code’s security patching capabilities. While some newer models showed promise, the average “pass rate” for AI-generated code was around 56%, and more than half of the models introduced detectable OWASP Top 10 vulnerabilities into the codebase.
These findings have significant implications for organizations relying on AI-powered vulnerability discovery and patching tools. As AI-generated code proliferates, the attack surface for malicious hackers grows exponentially. If these tools are unable to reliably fix vulnerabilities, it leaves companies vulnerable to attacks that can compromise sensitive data and disrupt operations.
So what’s going wrong? According to experts, the main issue lies in the limitations of current language models. These models often rely on shallow context and lack the nuance required for complex security patching tasks. Additionally, they may hallucinate or introduce new bugs as a result of their own errors or biases.
“It’s premature to treat AI-generated code as anything other than another code change that needs human review,” said Tim Jarrett, vice president of product at Veracode. “We need some kind of automated code review, but preferably not by the same automation tool that produced the code.”
Jarrett’s statement highlights the ongoing challenge in balancing the benefits of AI-generated code with the need for rigorous security testing and validation. While AI tools can generate vast amounts of code quickly and efficiently, they are still fallible and require human oversight to ensure their accuracy.
For organizations relying on AI-powered patching tools, this means that they must implement robust quality control measures to detect and correct errors before releasing new code into production environments. This may involve multiple layers of review, including manual testing and validation by human security experts.
Ultimately, the lesson from these studies is clear: while AI-generated code holds great promise, it’s still a tool in need of careful management and oversight. As we continue to rely on these tools for vulnerability discovery and patching, we must remember that trust but verify – or, in this case, trust but thoroughly review.
Source: CyberScoop — 2026-08-07