Q: Why is this test passing when it shouldnt'? So I have the following test:
it "should not update a user based on invalid info" do
    put :update, :id => @factory.id, :user => {
       :name => '', :user_name => '',
       :email => '', :email_confirmation => '',
       :password => '', :password_confirmation => 'dfgdfgdfg',
       :bio => '', :picture_url => ''
    }
end   

Which clearly has missing data.
I then have the following controller:
  def update
    @user = User.friendly.find(params[:id])
    @user.update_attributes(user_update_params)
    if @user.save
      render :show
    else
      render :edit
    end
  end

This has the following private method:
  def user_update_params
    params.require(:user).permit(:name, :user_name, :email, :email_confirmation, :password,
      :password_confirmation, :bio, :picture_url)
  end  

When this test is run it passes - it should give me a ActiveRecord::RecordInvalid 
If your interested this is the model:
class User < ActiveRecord::Base
  attr_accessor :password

  before_save :encrypt_password

  validates :name, uniqueness: true, presence: true
  validates :user_name, uniqueness: true, presence: true, length: {minimum: 5}
  validates :email, presence: true, confirmation: true, uniqueness: true, email_format: {message: "what is this? it's not an email"}
  validates :password, presence: true, confirmation: true, length: {minimum: 10}

  extend FriendlyId
  friendly_id :name, use: [:slugged, :history]

  def self.authenticate(user_name, password)
    user = User.find_by(user_name: user_name)
    if(user && user.password_hash == BCrypt::Engine.hash_secret(password, user.salt))
      user
    else
      nil
    end
  end

  def encrypt_password
    if password.present?
      self.salt = BCrypt::Engine.generate_salt
      self.password_hash = BCrypt::Engine.hash_secret(password, salt)
    end
  end
end

I also bet its something very trivial
Update Incase your interested this is my factory:
FactoryGirl.define do
  factory :user, :class => 'User' do
    name "sample_user"
    email "MyString@gmail.com"
    user_name "MyString"
    password "someSimpleP{ass}"
  end
end

so @factory is created from @factory = FactoryGirl.create(:user)

A: You're executing an RSpec method (put) that will not raise an error as long as the arguments are properly formed so that the message can be sent to the server. Since there was nothing wrong with your arguments per se, no error was raised. Any inability of the server to successfully complete the request will be reflect in the response, which you would need to test separately.
Of course, as others have pointed out, it's typical in an RSpec example to set "expectations" on your code which will determine whether the example succeeds or not, so that more than just the absence of an uncaught error will determine success.

A: Its not like that the test is not passing, but there is no test. You missed the expectation in your test.
Try something like this.
it "should not update a user based on invalid info" do
    put :update, :id => @factory.id, :user => {
       :name => '', :user_name => '',
       :email => '', :email_confirmation => '',
       :password => '', :password_confirmation => 'dfgdfgdfg',
       :bio => '', :picture_url => ''
    }
    #add expectation here
    response.should_not be_valid
end 

Any test without expectation would pass.
