Standard
Common Weakness Enumeration: a community-maintained taxonomy of software and hardware weakness types, used to classify and prioritize vulnerabilities.
Obada Kraishan of Texas Tech tracked 37,623 GitHub pull requests and found 90-day revert rates of 6.1% for OpenAI Codex and 14.5% for Devin. A pooled 'AI code' rate from that sample mostly measures Codex, so each tool needs its own numbers.
Reality
Three of the Crosswork flaws score a flat 10.0, and Cisco says each CVE bundles several underlying defects. No exploitation reported in the wild so far.
Perspective Coverage
3 publishersReality
AWS has published a 14,822-sample set that pairs real vulnerability patterns with controls that stop them. With direct prompting the 12 models it scored flagged between 41% and 99% of safe samples as exploitable.
Reality
Its review of fiscal 2024 and 2025 says opportunistic scanning of known, internet-exposed flaws drove most compromises. The fix, it argues, belongs to software producers, not to defenders patching faster.
Reality
A developer ran 200 flagged snippets past two frontier models with identical prompts. One cleared 51% of the false alarms; the other cleared 20% and agreed with 90% of what it saw. The countermeasures are a model property.
Reality
PlannerCritic's author tried to inject his own engine. The blocks arrived as feasibility verdicts rather than safety strings, which is a design worth copying and a limit worth reading closely.
Reality
The hosted Claude Security beta bills as ordinary Claude usage with no platform fee, while Mythos 5 stays with vetted partners. What runs the Enterprise scans is not settled by the sources.
Reality
GitHub's August release retunes Actions queries for cache poisoning, output clobbering and untrusted checkouts. Most of the work went into cutting false positives, not adding coverage.
Reality
A Secure Code Warrior and RMIT study of six frontier models across 11 frameworks found no universal winner and no link between token cost and secure output.
Reality