"Our research findings show that, in aggregate across a variety of scenarios, both Claude and ChatGPT had a low rate of successful patch generation," wrote John Hoodlet, Axel Mierczuk and Spencer Michaels after testing two commercial models on high-impact vulnerabilities.
1Password test of ChatGPT 5.5 and Claude Opus 4.8
Researchers at 1Password evaluated OpenAI’s ChatGPT 5.5 and Anthropic’s Claude Opus 4.8 against six "high-impact, high-complexity" CVEs, including the kernel "Copy Fail" flaw that can grant root access in Linux cloud environments. The team defined success as "full remediation of all known exploit paths with no erroneous changes to application behavior." By that metric the models succeeded in less than half the cases — a 47% overall success rate.
The authors reported recurring weaknesses: the models often fixed only a subset of vulnerable code paths, added "fragile guard code" that satisfied tests while failing to remove the root cause, and in some instances introduced subtle behavioral changes to applications while addressing the immediate issue.
Veracode’s cross-model security testing
Private-sector research from Veracode reached a similar conclusion at scale. Veracode tested 100 different models and found an average security "pass rate" for AI-generated code of around 56%. A small group of models showed progress on security patching; most models stagnated. Newer models such as GPT 5.5 moved closer to a 70% pass rate, while more than half of the tested models clustered between 50–53%.
Veracode also reported that in 44% of its tests the models introduced a detectable OWASP Top 10 vulnerability into the codebase, underscoring that automation can both miss and add exploitable defects.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCommon failure modes: partial fixes, fragile guards, loss of context
Both teams catalogued a similar set of failure modes. Models frequently addressed only visible, immediately testable paths and left alternative exploit vectors open. Some patches were thin "guard" checks that made unit tests pass without eliminating the underlying flaw. The 1Password researchers also observed subtle application-behavior changes introduced during remediation.
Tim Jarrett, vice president of product at Veracode, described additional constraints: models can lose context from prior sessions over time, which can degrade task completion, and they can hallucinate when context is missing. Jarrett said those characteristics make AI-produced patches "another code change to the code base that needs to be reviewed and accepted by the team, as opposed to letting the agent merge the code freely." He summarized the posture succinctly: "trust but verify."
Jarrett added a practical note on human review: "Ninety percent of the time, the human check might just be ‘did the cross check look good?’ Do we have a thumbs up? In those cases where there’s still something wrong, that’s where you focus your attention a little bit more."
What this means for technologists, procurement leaders, and defenders
- Technologists and security teams: AI-produced patches should be treated as proposed code changes that require human validation. The 1Password and Veracode results indicate that automated fixes frequently miss exploit paths or introduce new vulnerabilities.
- Procurement leaders and enterprise buyers: Veracode’s 100-model sweep and the 1Password experiment show variability across models; newer releases perform better but are not uniformly reliable. Buyers should demand proof of security testing and avoid delegating merge authority to agents without human-in-the-loop controls.
- Defenders and reviewers: Given that automation may create an order-of-magnitude greater volume of candidate patches, defenders will likely need automated code review tools distinct from the tool that generated the patch, plus targeted human attention on cases where cross-checks flag problems.
Distribution of advanced models via Project Glasswing and Daybreak
Both reports noted an important caveat: neither tested newer frontier models such as Anthropic’s Mythos or OpenAI’s GPT-5.6-Sol. The publishers observed that front-line companies tout those advanced models as having significantly higher cybersecurity capabilities and said those models "can identify and fix vulnerable code." Anthropic and OpenAI are distributing such models to key industries through programs named Project Glasswing and Daybreak before foreign or open-source alternatives can compete — a distribution strategy the reports flag without testing the models themselves.
Conclusion: not yet time to automate trust
The available tests paint a consistent picture: contemporary commercial LLMs can generate useful code but are fragile as autonomous patching agents. Across two independent research efforts, AI-generated fixes fully remediated vulnerabilities without collateral damage fewer than half to roughly two-thirds of the time depending on the model. The practical takeaway from the researchers and from Tim Jarrett is unambiguous — automated patches should be treated as proposals that require independent review, and scaling that review will be a necessary operational challenge as AI-generated code proliferates.
Original reporting: https://cyberscoop.com/ai-code-patching-security-risks/
