AI Patching Tools Fall Short: More Than Half of Generated Security Fixes Fail

New research examining AI's ability to fix security vulnerabilities has exposed significant limitations in current models, raising concerns about relying on generative AI for critical cybersecurity work. 1Password researchers tested OpenAI's ChatGPT 5.5 and Anthropic's Claude Opus 4.8 against six high-complexity common vulnerabilities, finding that both models achieved a success rate below 50% in fully resolving vulnerabilities without introducing new problems. Veracode's parallel study across 100 models found similar issues, with roughly 44% of tests resulting in models inadvertently introducing exploitable OWASP Top 10 vulnerabilities. While newer frontier models like Anthropic's Mythos and OpenAI's GPT-5.6-Sol reportedly show improved cybersecurity capabilities and are being distributed through Project Glasswing and Daybreak initiatives, these haven't yet been independently tested, leaving questions about their practical effectiveness for autonomous patching at scale.