More than half of AI-generated patches are broken
AI-generated security patches fail more than half the time, introducing new flaws.
New research indicates that AI-generated security patches are often ineffective, with success rates below 50% in fully remediating vulnerabilities without introducing new issues. Both OpenAI's ChatGPT and Anthropic's Claude models struggled, sometimes only partially fixing flaws or adding fragile code. This suggests that relying solely on AI for automated patching may not be viable yet, and human review remains critical.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearch shows that AI models like ChatGPT and Claude successfully remediate vulnerabilities less than 50% of the time, often producing partial fixes or introducing new fragile code. This matters because organizations increasingly look to AI-assisted automation to accelerate patching cycles, but deploying broken patches can create a false sense of security or even expand the attack surface. The root cause is an over-reliance on AI tooling without adequate human validation gates in the patching workflow. Until AI patch accuracy improves substantially, treating AI-generated code as a first draft — not a final fix — is essential to maintaining a defensible security posture.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Breach and attack simulation
You only find out whether your security tools stop an attack when a real attacker tries.
- Automated patch management
Known holes get closed in days, not months.