1Password Study: AI Models Fail to Properly Fix Security Bugs 74% of the Time

Silicon Valley has spent two years telling everyone that AI will write and secure your code faster and better than humans. A new study from 1Password says that's not true yet, at least not for patching real security flaws.

1Password's newly formed security research unit, Off-By-1-Labs, published the study Thursday. The team set out to test whether frontier AI models could reliably patch software vulnerabilities when given full access to open source code and public vulnerability disclosures, the exact kind of material these models are trained on.

The researchers went in expecting decent results. Their hypothesis was that AI models would hit something like a 67% success rate given how much relevant code and documentation they'd likely absorbed during training, according to 1Password. That's already not a great bar for something being sold as a security solution.

The actual numbers came in worse. Researchers said the results were "significantly lower and more uneven than we hypothesized," according to 1Password. The study, titled "Frontier Models' Vulnerability Patches are Often F.L.A.W.E.D. Fix-Like Artifacts With Embedded Defects," found AI models failed to properly patch vulnerabilities 74% of the time.

How the test worked

Off-By-1-Labs picked six recently disclosed vulnerabilities in open source software, chosen specifically because they were unlikely to have been part of the models' training data. That matters. It removes the possibility that a model just memorized the fix from GitHub instead of actually reasoning through the problem.

Claude and a coding agent built on OpenAI's Codex were both part of the test pool, according to 1Password. The team was clear that this wasn't meant to be a horse race between AI models. It was meant to be a broader gut-check on where LLM patching capability actually stands right now.

The scale of the test was substantial. The models generated 6,080 total patch attempts, roughly 3,040 per vulnerability, using nine different prompts and varying environmental conditions, according to 1Password. That's a lot of chances to get it right. Most of them didn't.

"FLAWED" patches that look fine but aren't

The core finding is what the researchers named "Fix-Like Artifacts with Embedded Defects," the acronym behind the FLAWED project. These are patches that look like they solve the problem on the surface. Code compiles. Tests might even pass. But the actual vulnerability is still there, or the fix is fragile enough to break under slightly different conditions, or the patch quietly introduces a brand-new bug, according to 1Password.

In some cases the researchers said patches even altered how the application normally behaves, which is its own kind of problem. A security fix that changes core functionality isn't really a fix. It's a new liability with a different shape.

This is a real concern for anyone deploying AI coding tools in production. Security teams already lean on AI to find vulnerabilities faster than human researchers can, something ZDNET has separately reported on. Finding a bug and correctly closing it are two different skills, and this study suggests the gap between them is bigger than the industry has been willing to admit.

The fair pushback

Defenders of AI-assisted coding would reasonably point out that this is a fast-moving field, that six vulnerabilities is a small sample, and that model capability six months from now could look very different than it does today. That's a legitimate point. AI coding tools have improved rapidly, and a single study using six CVEs isn't the final word on the technology's ceiling.

It's also true the researchers weren't running a comparison to see which model is "best." A 74% failure rate across the pool doesn't tell you whether a top-tier model configured carefully with human review might do meaningfully better than the average result. 1Password's own framing was explicit that this is a snapshot of current capability, not a verdict on the technology's future.

Still, the gap between the industry's marketing and this study's findings is wide. Companies are actively pushing AI agents that autonomously patch code with minimal human oversight. This research suggests that's premature, at least for anything touching real security vulnerabilities.

1Password has released its testing tool, also called FLAWED, on GitHub so other researchers can run their own versions of this experiment, according to 1Password. That's a useful next step. Independent replication with a larger set of vulnerabilities and a wider range of models would tell the industry whether this 74% failure rate holds up, or whether it's specific to the six bugs the team happened to choose. Until then, any company treating AI-generated patches as production-ready without a human security engineer checking the work is taking on risk the data doesn't yet support.