AI Coding Agents Write 2.7x More Vulnerable Code (October 2026)

Arnica reports a benchmark of six AI coding model-and-tool pairings in which agents completed ordinary feature tickets without explicit security requirements, finding that 47% of security decisions were incorrect overall and 58% were incorrect in held-out vulnerable open-source applications. The company says its repository-specific “agentic rules,” secure-coding instruction files delivered in formats each tool can read, reduced the overall error rate to 17% and the held-out rate to 32%, while lowering newly introduced critical or high-severity vulnerabilities per session from 2.5 to 1.4. The study used production-style multi-tenant applications and deliberately vulnerable public repositories, evaluated resulting code against predefined security decisions, independent scans, compilation checks, and audits of behavior changes, with a secondary model agreeing with the primary grading in 93.2% of sampled judgments. Rules reportedly improved authorization, SSRF, supply-chain, cross-site scripting, and secret-handling outcomes and increased remediation of pre-existing issues, but they did not eliminate vulnerabilities and were associated with more code changes and some increases in issues such as missing rate limits, race conditions, session-handling gaps, excess privilege, and weak cryptography. Arnica concludes that model selection, native rule deployment across multiple coding tools, testing, scanning, human review, and merge gates remain necessary parts of an application-security program.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.