Study: AI coding agents ignore security unless explicitly prompted

A study by Bappy et al. (2026) with 15 software engineers found that AI coding agents do not reliably produce secure code without explicit guidance. Only two participants independently spotted AI-introduced vulnerabilities, and both had prior security experience.

• Only 2 of 15 engineers independently found AI-introduced vulnerabilities
• Both had prior experience with common vulnerability classes
• AI-generated code regularly violates basic OWASP Top 10 issues
• Seniors name risks precisely; juniors defer security to review