TL;DR: A 1Password study found AI-generated security patches are largely ineffective, often failing to fix bugs and sometimes introducing new vulnerabilities.
Summary: Researchers at 1Password tested over 6,000 AI-generated patches from Claude and ChatGPT against real security vulnerabilities. The study revealed that AI successfully fixed bugs only 26% of the time, failed to fix the original bug in half of cases, and introduced new vulnerabilities 4.5% of the time. The researchers concluded that the effort to review AI-generated patches often exceeds the effort of writing the fix manually.
Why it matters: AI builders should be cautious about relying on current LLMs for automated security patching, as the technology is not yet reliable enough for critical applications. Focus on human-in-the-loop systems for security, using AI for assistance rather than full automation, and rigorously test any AI-generated code.
Source: x_com