[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa-Bruzm-MLDQM45e5V-hEfS_fJ9csw6laM9H87iespw":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"18736ef1-b897-4720-a4cb-fdd681f98b52","More than half of AI-generated patches are broken","more-than-half-of-ai-generated-patches-are-broken-54f61c","Research finds your AI generated security patch is more likely to fail than fully fix a vulnerability. It might even introduce brand new flaws to exploit along the way. The post More than half of AI-generated patches are broken appeared first on CyberScoop.","New research indicates that AI-generated security patches are often ineffective, with success rates below 50% in fully remediating vulnerabilities without introducing new issues. Both OpenAI's ChatGPT and Anthropic's Claude models struggled, sometimes only partially fixing flaws or adding fragile code. This suggests that relying solely on AI for automated patching may not be viable yet, and human review remains critical.","AI-generated security patches fail more than half the time, introducing new flaws.","https:\u002F\u002Fcyberscoop.com\u002Fai-code-patching-security-risks\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F08\u002FGettyImages-2283773187.jpg","2026-08-07T17:10:39+00:00","2026-08-07T18:00:13.758398+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"ChatGPT 5.5","product",{"name":21,"type":22},"OpenAI","vendor",{"name":24,"type":19},"Claude Opus 4.8",{"name":26,"type":22},"Anthropic",{"name":28,"type":29},"AI","technology",{"name":31,"type":29},"LLM","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[21,26,18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":84,"name":85,"problem":86,"products":87},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-enterprise","AttackIQ Enterprise","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fenterprise\u002F","Continuous, automated adversary emulation across the environment, with full control over scenarios and schedules.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":155},"ai-generated-patches-fail-more-than-half-the-time-human-oversight-is-still-essential","AI-Generated Patches Fail More Than Half the Time — Human Oversight Is Still Essential","Research shows that AI models like ChatGPT and Claude successfully remediate vulnerabilities less than 50% of the time, often producing partial fixes or introducing new fragile code. This matters because organizations increasingly look to AI-assisted automation to accelerate patching cycles, but deploying broken patches can create a false sense of security or even expand the attack surface. The root cause is an over-reliance on AI tooling without adequate human validation gates in the patching workflow. Until AI patch accuracy improves substantially, treating AI-generated code as a first draft — not a final fix — is essential to maintaining a defensible security posture.",[147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SP 800-218: Secure Software Development Framework (SSDF) — PW.7 (Review and test code)","NIST AI RMF: GOVERN 1.2 — Accountability for AI outputs","NIST AI RMF: MANAGE 2.2 — Human oversight of AI-generated decisions","ISO\u002FIEC 27001:2022 — A.8.8 Management of technical vulnerabilities","OWASP Software Assurance Maturity Model (SAMM) — Defect Management Practice",{}]