Topic starter
01/08/2026 8:56 pm
TL;DR: 65 to 75% of frontier AI agents’ working patches resurrect vulnerabilities already found and fixed, while functional success rose to 83 to 95% and secure-and-functional success stayed at 24 to 36%, according to Checkmarx research. The result is a widening gap between code that works and code that remains safe, making security review mandatory rather than optional.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Zombie CVEs: Put to Rest by Humans, Dug Back Up by AI Agents”.
By the numbers:
- 65 to 75% of frontier AI agents’ working patches resurrect vulnerabilities that were already found and fixed.
- Functional success surged to 83 to 95% across the cohort.
- 49% of production code is now AI-generated, according to Checkmarx’s 2026 Future of AppSec report.
Key questions
Q: What breaks when AI coding agents are used as the final authority on vulnerabilities?
A: False positives, unstable results, and shallow reasoning become operational failures rather than harmless noise.
Q: Why do AI coding agents keep reproducing vulnerabilities that humans already fixed?
A: Because these systems optimise for task completion and code similarity, not for preserving the security intent embedded in a patch.
Q: What are the signs that generative AI code is failing a security review?
A: The clearest signs are code that passes functional tests but introduces unsafe input handling, string concatenation with user data, or missing sanitisation.
Practitioner guidance
- Gate AI-generated code with security acceptance criteria Require generated changes to pass vulnerability checks, secure coding rules, and threat-model review before merge, especially when the feature resembles a previously fixed CVE path.
- Track recurrence of fixed vulnerabilities Add review logic that flags when generated code resembles a previously remediated weakness, so teams can spot regression patterns instead of treating each defect as new.
- Separate functional success from secure success Measure AI coding workflows with two outcomes, working code and secure code, so teams do not confuse feature completion with safe delivery.
Bottom line: AI coding agents can produce working patches that reintroduce vulnerabilities already fixed, which makes regression control a core software assurance issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:04 pm
AI code generation is becoming a governance problem, not just a productivity problem. When a machine can repeatedly reintroduce fixed vulnerabilities into working code, the control failure sits in the delivery pipeline, not just in developer judgment. That means review gates, provenance, and release policy have to treat AI-generated code as a governed non-human output. Practitioners should manage it like any other high-volume producer of change.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools. Define who can start the workflow, which tools and data sources it can reach, what evidence is required for review, and how access is revoked if the workflow expands beyond its intended scope. The key is to govern the chain of delegated action, not only the final code output.
👉 Read our full editorial: AI coding agents are resurrecting old CVEs in production code