{"id":374526,"date":"2026-08-07T03:44:00","date_gmt":"2026-08-07T10:44:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=374526"},"modified":"2026-08-07T03:44:41","modified_gmt":"2026-08-07T10:44:41","slug":"1password-study-only-26-of-ai-security-patches-fully-fix-flaws","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/1password-study-only-26-of-ai-security-patches-fully-fix-flaws\/","title":{"rendered":"1Password study: only 26% of AI security patches fully fix flaws"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/1password.en.softonic.com\/\" rel=\"noopener\">1Password<\/a>\u2019s Off-by-1 Labs has published a new study on AI-generated security patches, examining <strong>6,080<\/strong> fixes for six recently disclosed vulnerabilities. By the lab\u2019s count, only 26% fully remediated the issue without changing application behavior. 49.3% still left at least one exploitable attack path in place, 20.1% fixed the flaw but changed behavior, 2.3% introduced a new vulnerability, and 2.2% did both: they failed to fix the original problem and added a new weakness.<\/p>\n\n<p class=\"wp-block-paragraph\">To reduce the chances that the models were simply recalling training data, the researchers used OpenAI\u2019s <a href=\"https:\/\/chatgpt.en.softonic.com\/\" rel=\"noopener\">ChatGPT-5.5<\/a> and Anthropic\u2019s Claude Opus 4.8 on recent CVEs. The results were rough. For <strong>complex flaws<\/strong>, 53.9% of the patches were marked \u201cFLAWED,\u201d meaning the code looked convincing on the surface and sometimes even passed early tests.<\/p>\n\n<p class=\"wp-block-paragraph\">Even then, the researchers say <strong>more than one-third<\/strong> of the fixes that initially seemed successful were later judged fragile. Some blocked a proof of concept, including the SpringAI character-filter cases, but still didn\u2019t address the root cause or account for architectural intent, business requirements, security consequences, or long-term maintainability.<\/p>\n\n<p class=\"wp-block-paragraph\">If you use <a href=\"https:\/\/en.softonic.com\/downloads\/ai-developer-tools\" rel=\"noopener\">automated coding tools<\/a> for security work, this update is worth a look. Those tools can speed up development and help with triage, but when <strong>security-sensitive code<\/strong> and customer data are on the line, you still need skilled human review. An autonomous fix engine isn\u2019t enough.<\/p>\n\n<p class=\"wp-block-paragraph\">You can read the Off-by-1 Labs research online.<\/p>","protected":false},"excerpt":{"rendered":"<p>1Password\u2019s Off-by-1 Labs has published a new study on AI-generated security patches, examining 6,080 fixes for six recently disclosed vulnerabilities. By the lab\u2019s count, only 26% fully remediated the issue without changing application behavior. 49.3% still left at least one exploitable attack path in place, 20.1% fixed the flaw but changed behavior, 2.3% introduced a &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/1password-study-only-26-of-ai-security-patches-fully-fix-flaws\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;1Password study: only 26% of AI security patches fully fix flaws&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9332,"featured_media":374525,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[6771],"class_list":["post-374526","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","content-category-ai"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/374526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9332"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=374526"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/374526\/revisions"}],"predecessor-version":[{"id":374527,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/374526\/revisions\/374527"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/374525"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=374526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=374526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=374526"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=374526"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=374526"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=374526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}