AI can now write a patch for almost any vulnerability in minutes. That changes the equation of what AI can do for remediation, but it doesn’t change the question every security team has always faced: which fixes are worth making?
Go ahead: take an agent and point it at an unprioritized backlog. The volume problem doesn’t go away, because each AI remediation costs tokens and requires human review and deployment. And each fix carries its own chance of breaking something immediately or downstream.
And the punch line is that risk isn’t reduced this way. When most of an existing backlog was never going to be exploited anyway, the organization pays dearly in terms of both resources and budget in exchange for very little risk reduction.
Whether to patch is a probability question
The decision to patch is a trade. On one side lies the expected danger from leaving a vulnerability alone, most notably that it might be exploited by a threat actor. On the other side is everything that the fix requires, including the chance that the fix itself causes harm.
That trade is only worth making if a potential exploit is a real probability. Using EPSS as an example, a score of 0.20 corresponds to a validated 20% likelihood of exploitation activity observed in the wild in the next 30 days. Depending on your organization’s tolerance for risk, that may well be a bet worth making. And using solutions that are far superior to EPSS, such as Empirical’s Foundation and Radiant security models, this bet becomes even easier to make.
But most scores in use today are not calibrated. CVSS measures severity, not likelihood. Many vendors take a calibrated model and shift it with unmeasured features such as asset tags, reachability or threat intelligence, without retraining or recalibrating. The number still looks like a probability, but it no longer matches any real-world frequency. Our co-founder & CTO Michael Roytman calls this risk model slop: ”the unmeasured, unvalidated accumulation of distortions that breaks the quantitative integrity of a probability model.”
With an uncalibrated score, the patch decision is not connected to the probability of an exploit. A threshold of 0.5 maps to no particular volume of work and no particular amount of risk removed. An AI agent triggered by that threshold inherits a malformed and mutated risk score, and then it takes action.
Let’s look at the problems with AI remediation using an uncalibrated score.
1. The remediation becomes attack surface
Mass automated upgrading pulls in new code, and new code at scale can invite new attacks. An example is the Axios compromise in March of 2026. Just five minutes after the malicious axios@1.14.1 package was uploaded to npm, GitGuardian observed the first public repository package file modified by Dependabot to pull the poisoned version. GitGuardian then tracked at least 895 public repositories that upgraded to the malicious version during the infection window. Of 141 pull requests opened by Dependabot and Renovate, 95 were merged, 50 of them by a bot with no human in the loop. One landed in a production branch 56 minutes after the malicious release.
The standard defence is a release cooldown of a few days. But security-motivated auto-upgrades often skip this protection. An agent aggressively fixing low-likelihood CVEs trades, say, a 1% exploit probability for a real chance of importing a compromised release.
2. The review cycle is flooded
Alert fatigue keeps developers from fixing critical vulnerabilities quickly enough. In Cycode’s 2024 State of ASPM survey of 500 US security and DevSecOps leaders, 85% said alert fatigue on dev teams strains the relationship with security
But AI adds a twist: generating remediations becomes seemingly easy, so AI-generated remediations flood the human review step. Review quality drops exactly when human-in-the-loop matters most.
3. Dashboards go green while risk stays flat
Volume metrics reward closing tickets. But it’s the wrong metric; what needs reporting is how many exploitable vulnerabilities were retired in the last 30 days, and the effort it took to do so. Celebrating a mountain of finished patches is meaningless.
4. Patching isn't always the right response
What about critical vulnerabilities that are weaponized before a patch even exists? For these CVEs, shooting remediations out of an AI-powered cannon is the wrong tactic. The right response is mitigation, compensating controls or segmentation. A program that routes everything through "AI generates a patch" misses a critical strategic step.
5. Token costs scale with volume, not risk
One fix is cheap; research pipelines can be as low as $0.07 per issue with the cheapest model (VulnResolver). This works out to roughly $2.80 per attempt in PatchBench, where 11 agents across 213 tasks cost about $6,500 (PatchBench).
At enterprise scale the numbers stop being small. One Empirical customer carried over a million open findings from a single scanner. At even a few cents per remediation, that gas pump meter runs up fast even when accounting for duplications.
6. The fix can carry a new flaw
Veracode's 2026 GenAI Code Security report puts the average security pass rate of AI-generated code at 56%, barely changed from 55% in its first report. It’s surprising that this number didn’t move.
This report isn’t necessarily highlighting remediation patches, but again, human-in-the-loop is required to make sure the fix is sound. And you don’t want your humans flooded with reviews that don’t matter (see point #2).
AI remediation has promise, but aim before you fire
AI remediation is worth exploring and deploying. But its value depends entirely on what your AI agent is pointed at, so make sure you’re using the right rifle scope. This article from Social Capital unpacks additional dangers in using AI to fix the wrong things, or accelerate inefficient processes.
Here’s a suggested process for using the agent correctly:
Score every finding with a calibrated probability of exploitation, ideally one trained on your own environment.
Decide the response: patch, mitigate, accept or monitor. Not everything needs a patch.
Hand the patch queue, and only that queue, to an agent, with a human reviewing changes in proportion to their risk.
Report exploitable exposure retired, not tickets closed.
A model trained and calibrated on an organization's own data fixes the prioritization problem, using exploit probability, reachability, compensating controls and asset criticality among many other factors. The output is work that human reviewers can actually absorb, and success is measured by the quantity of risk that is ultimately reduced.
Forrester analyst Erik Nost introduces the concept of Proactive Security and how vulnerability management and attack surface management are beginning to merge. According to Nost, the best platforms enable organizations to find, prioritize, own, and remediate risk. He writes, “Don’t focus on a platform that finds the most problems — choose the one that helps your organization fix the right ones at scale.”
We agree. Use your security model to identify the (relatively) small set of vulnerabilities most likely to be exploited in the next 30 days. Assess the risk and the approach. Then deploy your agents accordingly.
Because automation makes a good prioritization decision faster, and it makes a bad one faster too.
