AI写代码又快又好看，但安全只有四分之一
AI 写代码已经成了常态，但没人认真查过它写出来的东西安不安全。这篇评测用 150 个真实漏洞造了 450 道题，让 6 个最强 AI 编程助手去写，结果功能上 73% 到 91% 都能跑通，可同时保证功能和安全的比例，最好的也只有 25.1%。也就是说，AI 写的代码里，每四份就有三份带着安全隐患——而且题目只要求功能、完全不提安全，AI 自己根本不会主动去防。这不是你明天能拿来用的工具，但它说明一件事：让 AI 替你写代码，等于默认接受了它把漏洞一起写进去。
📄 原文摘要(英文)
AI coding agents now write much of the code that ships, yet whether that code is secure remains unclear. We introduce the Last Secure Code Benchmark, a comprehensive evaluation of secure code generation by coding agents. Built from 150 real vulnerabilities, its 450 tasks span seven widely used languages (Java, C, C++, JavaScript, Python, PHP, and Go), 24 CWEs including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV weaknesses, more than any benchmark we compare with, and three vibe-coding scenarios: filling in a function, writing a file, and building a repository's source tree from scratch. Every task asks only for functionality, through a specification that never mentions security, and hidden functional and security tests grade the result. Across six frontier agents, 73.6% to 91.3% of tasks pass functionally, yet even the strongest, Claude Fable 5, produces code that is both functional and secure for only 25.1% of tasks, and the others for 16.4% to 24.7%. The best model only passes 12% of the vulnerability scenarios across all vibe coding setting, posing strong concern on the security of the code written by vibe coding.