Top AI coding agent writes secure code just 25% of the time

The strongest AI coding agent in a new benchmark produces code that is both functional and secure only 25.1% of the time. That is the headline result of the Last Secure Code Benchmark, submitted to arXiv on October 10, 2026.

The authors built 450 tasks from 150 real vulnerabilities, spanning Java, C, C++, JavaScript, Python, PHP and Go. The tasks cover 24 CWEs, including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV weaknesses. Each task is framed with no mention of security: "Every task asks only for functionality, through a specification that never mentions security, and hidden functional and security tests grade the result."

Across six frontier agents, the paper reports that "73.6% to 91.3% of tasks pass functionally, yet even the strongest, Claude Fable 5, produces code that is both functional and secure for only 25.1% of tasks, and the others for 16.4% to 24.7%." On harder tests, the authors write that "the best model only passes 12% of the vulnerability scenarios across all vibe coding setting."

The paper closes on what it calls a "strong concern on the security of the code written by vibe coding." The abstract names only Claude Fable 5 among the six agents and does not publish per-model or per-language breakdowns.