AI-written code passes its tests far more often than its security tests
In Semgrep's run, Claude Opus 5.5 wrote working code for 93.5% of 186 real-CVE tasks and working, secure code for 54.8%. Why tests miss it, what to check.
Security review
Every post on this topic, newest first.
Updated 2 OCT 2026
Keeping an AI agent inside its limits: controls that sit outside the model
What holds when an AI agent ignores its instructions: egress and DNS rules, brokered credentials, sandboxes, caps, automatic stops, logs and approvals.
The 90 firms that fix AI-generated code
What 90 firms that fix AI-built apps say they fix, how they package the work, and a checklist to use on any of them.