AI is writing security patches, but half of them fail

CISOs are moving from AI-powered vulnerability discovery to AI-generated patches, but research from 1Password's Off-by-1 Labs found more than half of LLM-written patches either fail to fix the issue or introduce a new one. Microsoft published more CVEs in October than in all of 2025, while Google has used its CodeMender agent for internal patching since October 2025.

• Over 50% of LLM-written patches fail to fix the flaw or add a new one
• About 66,000 vulnerabilities are expected to be reported in 2026
• Microsoft published more CVEs in October than in all of 2025
• Google has used CodeMender with Gemini for patching since October 2025