AI vulnerability patching has a grading problem

Researchers at Northwestern University tested AI coding agents on 112 real security bugs and found that patches which stop a crash often fail the maintainer-written tests for the fix, with Claude Opus 4.7 producing patches that eliminated the crash but still failed those maintainer tests in a third of cases. The finding indicates that security patching benchmarks may overstate agent success by grading on crash elimination rather than maintainer acceptance criteria.

Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests. If you’re thinking about letting an AI tool patch vulnerabilities for you, this is the number to look at. Many security patching benchmarks … More https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/ The post AI vulnerability patching has a grading problem https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/ appeared first on Help Net Security https://www.helpnetsecurity.com .