> we tried letting the model write its own patches and watched a few go out that fixed the original bug while quietly breaking something else the code depended on.

This is something I've been anticipating. Imagine this happening on a 500k+ line project scattered across 10+ repos.

It would be easier and cheaper to pay me to rewrite the whole thing from scratch than to fix all the vulnerabilities.