AI Security Patches: Often Flawed, Need Human Oversight

AI-generated security patches often fall short of fully solving problems. Researchers tested AI fixes on six vulnerabilities, creating over 6,000 patches. Only about a quarter of these patches fully resolved the issue. What's interesting is that nearly half of the patches failed to fix at least one exploit path. Some fixed the original problem but changed how applications behaved, and a small percentage even introduced new security flaws. Experts warn that AI without human oversight often creates "Fix-Like Artifacts With Embedded Defects," or FLAWED patches, which can be a net negative. However, when AI receives better guidance, its success rate significantly improves to 65%. This highlights the critical need for human review. To help with this, researchers released a patch evaluation tool, also called FLAWED. This tool helps organizations determine the effectiveness of AI-generated fixes. The bottom line is that human oversight remains crucial for effective cybersecurity.