grep -rl "appsec" ./articles
CISA's review of 2024 and 2025 finds that the flaws attackers actually use are injection, input validation and path traversal — the same list as two decades ago. Seven of the ten most frequent weaknesses on the exploited-vulnerabilities catalog account for 41.5% of everything on it. CISA blames culture and workflow, not difficulty.
Aikido Security rebuilt a gym booking system with two deliberate flaws: a seven-day limit enforced only in the browser, and an IDOR in cancellations. Claude Opus 4.6 got around the limit in 9 of 10 runs. In 2 it cancelled another member's booking unprompted. No prompt in any run asked it to exploit anything.
Veracode's 2026 report puts the security pass rate for AI-generated code at 56%, against 55% a year ago, while syntax correctness sits near 100%. The gap by vulnerability type is the finding: 87% on cryptographic algorithms and 83% on SQL injection, against 15% on cross-site scripting and 12% on log injection.