AI is writing patches, how much should we trust them?

Research from 1Password's Off-by-1 Labs published in August found that more than half of LLM-written security patches either failed to fix the issue or introduced a new one, as CISOs increasingly deploy AI-generated patches against rising AI-powered attacks. IBM Enterprise Security Exec Jamie Thomas told The Stack that roughly 66,000 vulnerabilities are expected to be reported this year, saying "the remediation is really the difficult part." Google has used its CodeMender AI agent for internal patching since October 2025, while Microsoft published more CVEs for October than in all of 2025.

As AI-powered cyber attacks soar, CISOs have moved beyond using AI models to identify security vulnerabilities to deploying AI-generated patches. But those patches can create a whole new class of headaches. Research from 1Password’s Off-by-1 Labs https://1password.com/blog/why-ai-generated-patches-still-require-human-review?ref=thestack.technology published in August found more than half of LLM-written patches either failed to fix the issue or added a new one as well. “Many reports are saying that this year we'll get to about 66,000 reported vulnerabilities that we have to be concerned with,” IBM Enterprise Security Exec Jamie Thomas told The Stack in a recent interview. “Now it's not about finding the vulnerabilities - the remediation is really the difficult part.” The issue only seems to set to increase, in the short term at least, with Microsoft warning of a growing list of patches in each of its Patch Tuesday releases, and publishing more CVEs for October https://www.thestack.technology/microsoft-just-pushed-more-patches-in-a-day-than-it-did-in-all-of-2025/ than it published in the entirety of 2025. Security defenders have increased their use of AI tools to address the gap between vulnerability discovery and their ability to patch them, with OpenAI launching a “ Patch the Planet https://openai.com/index/patch-the-planet/?ref=thestack.technology ” initiative in June to supply AI tools for remediating vulnerabilities in open source projects. Notably, Google has also used its CodeMender AI agent https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/?ref=thestack.technology for patching internally since October 2025. “CodeMender utilizes Agent Platform capabilities and Gemini models to find vulnerabilities in code, write fixes, and securely test them, giving developers final approval and control,” DeepMind’s Head of Gemini Security Raluca Ada Popa told The Stack .