LSCBench: Vibe Coding Agents Write Functional Code, But Only 25% Is Also Secure
Qwen · hf · 2026-10-14
Alibaba's Qwen team, NUS, and Alibaba Cloud Security release the Last Secure Code Benchmark (LSCBench), evaluating secure code generation by coding agents. Built from 150 real vulnerabilities, its 450 tasks span 7 languages (Java, C, C++, JavaScript, Python, PHP, Go) and 24 CWEs — including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV — across three vibe-coding scenarios: filling in a function, writing a file, and building a repo from scratch. Specs mention only functionality; hidden functional and security tests do the grading.
Results are sobering: six frontier agents pass 73.6%-91.3% functionally, but the best (Claude Fable 5) produces code that is both functional and secure in only 25.1% of tasks (others 16.4%-24.7%), and the strongest model passes just 12% of vulnerability scenarios across settings.
More from coding & agent
- Epic Games Store vibecoded rewrite is now twice as fast as Steam, says Epic — Charuru · 2026-10-14
- SlashVibe, a physical controller for AI agents, hits Kickstarter October 27 — sujingshen · 2026-10-14
- ComfyUI node brings NVIDIA RTX VSR to long videos with disk-backed, low-RAM processing — Away_Exam_4586 · 2026-10-14
- Rosebud AI lets coding agents publish your browser game with free hosting and a play link — lishali88 · 2026-10-14
- 256 real mobile jobs: Claude Haiku 5.5 ties GPT-6 Luna despite 23.5-point benchmark gap — LovesWorkin · 2026-10-14
- Claude Code 2.1.300 Is About to Drop, No Changelog Yet — ClaudeCodeLog · 2026-10-14