Nothing asked, so nothing held — coding agents ship functional code nine times in ten and secure code one time in four, and the only AI Act date left this year is a label

The Last Secure Code Benchmark, arXiv:2610.14766v1, submitted 10 October 2026, is built from 150 real vulnerabilities and comprises 450 tasks spanning seven languages (Java, C, C++, JavaScript, Python, PHP, Go) and 24 CWEs, including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV weaknesses.

Why it mattersFixes the identifier, the date and the scope of the benchmark so a later edition cites the right document.

arxiv2026last · lastsecurec2026last

Every task specification in the benchmark asks only for functionality and never mentions security; hidden functional and security test suites grade the result, and a task counts only if both pass.

Why it mattersThe grading rule is the whole story: an acceptance suite that never names security cannot reward it.

arxiv2026last · lastsecurec2026last

Across six frontier agents, 73.6% to 91.3% of tasks pass functionally, while only 16.4% to 25.1% produce code that is both functional and secure; the strongest on the combined measure is Claude Fable 5 at 25.1%.

Why it mattersThe headline gap. A functional pass rate is not a quality signal when the security rate is a quarter of it.

arxiv2026last · lastsecurec2026last

The agent with the highest functional pass rate on the published leaderboard, Kimi-K3 in Claude Code at 91.3%, has the lowest functional-and-secure rate of the six at 16.4%; Claude Fable 5 in Claude Code scores 91.1% functional and 25.1% functional-and-secure.

Why it mattersKills the intuition that a better coding agent is a safer one. On this board the ranking inverts.

lastsecurec2026last · github2026alibabala

For Claude Fable 5 the security pass rate is 25.3% and the functional-and-secure rate is 25.1%, a difference of two tenths of a percentage point, so security rather than functionality is the binding constraint.

Why it mattersTells an engineer where the budget goes: the constraint is security, not getting the code to work.

lastsecurec2026last · github2026alibabala

The benchmark's security suite replays the original proof-of-concept attack against the running program in a separate container after the agent stops, with no partial credit and no judge model.

Why it mattersA replayed proof-of-concept against a running program is a stronger signal than a static-analysis finding, and worth copying into a team fixture.

github2026alibabala · lastsecurec2026last

The best model solves only 12.0% of the 150 vulnerability scenarios at all three granularities (function, file, repository) with code that is both functional and secure; the project leaderboard defines this column as the share of the 150 scenarios solved at all three granularities, which resolves the scope of the abstract's '12%' figure.

Why it mattersResolves the scope of the abstract 12% figure against the project leaderboard own column definition, so it is not quoted loosely later.

arxiv2026last · lastsecurec2026last

Averaged across the six agents the functional pass rate falls from about 93% at function granularity to about 80% at repository granularity, while the functional-and-secure rate stays between 19% and 23% across all three granularities.

Why it mattersRules out the comfortable reading that the risk arrives with autonomy. It is present at the smallest unit of work.

lastsecurec2026last

AI Act Article 50(2) requires providers of AI systems generating synthetic audio, image, video or text content to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, so far as technically feasible, and does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics. Article 50 has applied since 2 August 2026 and the marking obligation lands 2 December 2026.

Why it mattersThe AI Act limb that actually lands this year, and what it does and does not ask for.

euaiactexpl2026article

The Digital Omnibus, Regulation (EU) 2026/1744, in force 27 July 2026, moved Annex III high-risk obligations including Article 14 human oversight to 2 December 2027 and Annex I to 2 August 2028, so no AI Act duty in force today addresses the security of code an agent writes.

Why it mattersSeparates the deferred duties from the live one so a reader does not plan against 2027 dates that do not bind them today.

euaiactexpl2026article

Regulation (EU) 2024/2847, the Cyber Resilience Act, applies its main obligations including the essential requirements on limiting attack surfaces from 11 December 2027, while its Article 14 reporting duty for actively exploited vulnerabilities has applied since 11 September 2026.

Why it mattersThe instrument that would speak to attack surface, and the date it starts to.

europeancom2026timeline

The arXiv abstract page for 2610.14766 lists no author affiliations; the project's own repository and site attribute the work to the Qwen Team and Cloud Safety and Security at Alibaba Group and to the National University of Singapore. arxiv.org/abs and arxiv.org/html were both rate-limited at HTTP 429 during this run and the metadata was taken from the arXiv export API.

Why it mattersRecords how the affiliations were obtained and that the arXiv pages were unreachable, so a later run does not re-derive them from an aggregator.

arxiv2026last · github2026alibabala