1Password’s Off-by-1 Labs has published a new study on AI-generated security patches, examining 6,080 fixes for six recently disclosed vulnerabilities. By the lab’s count, only 26% fully remediated the issue without changing application behavior. 49.3% still left at least one exploitable attack path in place, 20.1% fixed the flaw but changed behavior, 2.3% introduced a new vulnerability, and 2.2% did both: they failed to fix the original problem and added a new weakness.
To reduce the chances that the models were simply recalling training data, the researchers used OpenAI’s ChatGPT-5.5 and Anthropic’s Claude Opus 4.8 on recent CVEs. The results were rough. For complex flaws, 53.9% of the patches were marked “FLAWED,” meaning the code looked convincing on the surface and sometimes even passed early tests.
Even then, the researchers say more than one-third of the fixes that initially seemed successful were later judged fragile. Some blocked a proof of concept, including the SpringAI character-filter cases, but still didn’t address the root cause or account for architectural intent, business requirements, security consequences, or long-term maintainability.
If you use automated coding tools for security work, this update is worth a look. Those tools can speed up development and help with triage, but when security-sensitive code and customer data are on the line, you still need skilled human review. An autonomous fix engine isn’t enough.
You can read the Off-by-1 Labs research online.
Author: Anthony John Padilla
{
"social": {
"email": "content.reviewer90@ext.softonic.com",
"facebook": "",
"twitter": "",
"linkedin": "https:\/\/www.linkedin.com\/in\/anthony-padilla-330a04299\/"
},
"ja-JP": "",
"de-DE": "Anthony Padilla ist ein auf den Philippinen ansässiger Schriftsteller mit Erfahrung in redaktionellen, digitalen und markenorientierten Inhalten. Seine Arbeit konzentriert sich darauf, komplexe Ideen in klare, verständliche Texte umzuwandeln.",
"en-US": "Anthony Padilla is a Philippines-based writer with experience across editorial, digital, and brand-focused content. His work centers on translating complex ideas into clear, accessible copy, with a strong emphasis on structure, accuracy, and user-focused communication. He has contributed to long-form articles, product and platform copy, and marketing-led editorial pieces.",
"es-ES": "Anthony Padilla es un escritor con base en Filipinas con experiencia en contenido editorial, digital y enfocado en marca. Su trabajo se centra en traducir ideas complejas en textos claros y accesibles.",
"fr-FR": "Anthony Padilla est un écrivain basé aux Philippines ayant de l'expérience dans le contenu éditorial, numérique et axé sur la marque. Son travail consiste à traduire des idées complexes en textes clairs et accessibles.",
"it-IT": "Anthony Padilla è uno scrittore con base nelle Filippine con esperienza in contenuti editoriali, digitali e focalizzati sul brand. Il suo lavoro si concentra sulla traduzione di idee complesse in testi chiari e accessibili.",
"nl-NL": "Anthony Padilla is een schrijver gevestigd op de Filipijnen met ervaring in redactionele, digitale en merkgerichte content. Zijn werk richt zich op het vertalen van complexe ideeën naar helder, begrijpelijke teksten.",
"pl-PL": "Anthony Padilla to pisarz mieszkający na Filipinach z doświadczeniem w tworzeniu treści redakcyjnych, cyfrowych i skoncentrowanych na marce. Jego prace skupiają się na przekształcaniu skomplikowanych idei w jasne, zrozumiałe teksty.",
"pt-BR": "Anthony Padilla é um escritor baseado nas Filipinas com experiência em conteúdo editorial, digital e focado em marca. Seu trabalho se concentra em traduzir ideias complexas em textos claros e acessíveis."
}
View all posts by Anthony John Padilla
