Defenders are increasingly turning to LLMs to to generate vulnerability patches. But our research showed that LLMs only successfully generate patches (without materially changing application behavior) 26% of the time.