If you think your AI coding agent is shipping production-ready code because it passed the unit tests, you are lying to yourself. The newly released Last Secure Code Benchmark (LSCBench), submitted to arXiv on October 10, 2026, by researchers from the National University of Singapore and Alibaba Group, exposes a terrifying reality: the best frontier agents fix 91.1% of broken code but only secure 25.1% of it. This isn't a minor oversight; it is a systemic failure where agents prioritize the friendly user while completely ignoring the hostile one.

The Kimi-K3 Paradox

The data presents a stark counter-intuitive finding. Kimi-K3 achieved the highest functional pass rate at 91.3%, yet it had the lowest security score at just 16.4%. In one specific test involving a Java configuration importer, Kimi-K3 passed all 14 functional tests but failed all 4 security tests. The agent used SnakeYAML's default Yaml() constructor, which honors every !!class tag in untrusted YAML, leaving a classic deserialization hole open. Meanwhile, Claude Fable 5 and GPT-5.6-Sol used SafeConstructor and passed both suites. The lesson is clear: a green test suite tells you absolutely nothing about whether your code is safe to ship.

Graded Like An Attacker

LSCBench is designed to be adversarial. It took 150 real vulnerabilitiesβ€”115 from public CVEs and 35 from expert-written Java applicationsβ€”and asked agents to fix them without ever mentioning security in the prompt. The agents ran inside Claude Code v2.1.143 and Codex v0.154.0. The benchmark used dual hidden suites: one for functionality and one that replays the original attack. Across 2,700 runs, 66% of the outputs worked but remained vulnerable. Worse, 57 of the 150 scenarios were never secured by any model, not once, across six frontier agents. The failure mode isn't a bug in the logic; it is an omission of the safe API.

The One-Sentence Patch That Isn't Enough

The researchers tested if a simple prompt injection could fix this. They appended one sentence to every task: implement the feature "while also being secure." The results were mixed but encouraging. GPT-5.6-Sol's secure rate jumped from 24.7% to 46.2%, and GLM-5.3 went from 21.3% to 38.2%. However, the paper notes that most tasks remained insecure even with the reminder. SSRF and information exposure vulnerabilities persisted near the bottom of the leaderboard. The agents still failed to model the system, leaving doors open for URL-based attacks and config dumps, proving that security is a retrieval problem that a single prompt line cannot fully solve.

Key Takeaways

  • Green tests do not equal shippable code; you must verify security separately.
  • The safe API (like SafeConstructor or argv lists) is usually available, but agents rarely retrieve it without explicit prompting.
  • Adding a security reminder to your AGENTS.md or CLAUDE.md can nearly double secure output rates for some models.
  • SSRF and information exposure are the hardest for agents to fix because they require system-level context, not just local code logic.

The Bottom Line

Stop treating functional pass rates as a proxy for security. The gap between 'works' and 'safe' is a chasm, and unless you explicitly prompt for security or run adversarial test suites, your agents are shipping vulnerabilities alongside features.