As AI-powered cyber attacks soar, CISOs have moved beyond using AI models to identify security vulnerabilities to deploying AI-generated patches. But those patches can create a whole new class of headaches.
Research from 1Password’s Off-by-1 Labs published in August found more than half of LLM-written patches either failed to fix the issue or added a new one as well. “Many reports are saying that this year we'll get to about 66,000 reported vulnerabilities that we have to be concerned with,” IBM Enterprise Security Exec Jamie Thomas told The Stack in a recent interview. “Now it's not about finding the vulnerabilities - the remediation is really the difficult part.”
The issue only seems to set to increase, in the short term at least, with Microsoft warning of a growing list of patches in each of its Patch Tuesday releases, and publishing more CVEs for October than it published in the entirety of 2025.
Security defenders have increased their use of AI tools to address the gap between vulnerability discovery and their ability to patch them, with OpenAI launching a “Patch the Planet” initiative in June to supply AI tools for remediating vulnerabilities in open source projects.
Notably, Google has also used its CodeMender AI agent for patching internally since October 2025. “CodeMender utilizes Agent Platform capabilities and Gemini models to find vulnerabilities in code, write fixes, and securely test them, giving developers final approval and control,” DeepMind’s Head of Gemini Security Raluca Ada Popa told The Stack.
