WHY AI-GENERATED VULNERABILITY PATCHES STILL REQUIRE EXPERT HUMAN REVIEW

Summary from the TLDR InfoSec newsletter

1Password's Off-by-1 Labs tested ChatGPT-5.5 and Opus 4.8's abilities to generate patches for six recent, high-profile CVEs when running as part of the respective organizations' cyber reduced guardrails programs. The test setup involved generating 540 patches per vulnerability in batches of 20 and testing whether they fixed the vulnerability, changed application behavior, and/or introduced new vulnerabilities. 1Password found that only 26% of patches fixed the vulnerability without changing application behavior or introducing new vulnerabilities.