Zombie CVEs: Put to Rest by Humans, Dug Back Up by AI Agents 

New research: 65–75% of frontier AI agents’ working patches resurrect vulnerabilities that were already found, fixed, and buried. 

In 2023, a path traversal vulnerability in Starlette, one of Python’s most popular web frameworks  – was found, disclosed as CVE-2023-29159, and fixed. Case closed. The bug was dead and buried, like hundreds of thousands of CVEs before it: discovered by researchers, patched by maintainers, laid to rest by the security community’s accumulated, painstaking work. 

In 2026, a frontier AI coding agent rebuilt that same feature. The vulnerability walked right back out of the ground. And it wasn’t a one-off.  

That is the one of the central findings of new independent research Checkmarx commissioned from Ilya Kabanov, CEO of The Weather Report — the first study to measure, generation over generation, whether AI code is getting safer as it gets better. 

The answer is not. In fact, ironically, it’s quite the opposite.  

Security, it seems, is simply not a benchmark in the AI agents’ arms race toward ever-greater capability. And the result is AI output that, in the way that matters, is getting unsafer: a generation ago, most insecure attempts didn’t even work, so they never shipped. Now nearly everything works, everything ships, and according to the research, 65–75% of it trips over the same old CVEs the industry already resolved, dragging them back into production. 

Read the Full Research

The graveyard test 

Rather than invent yet another benchmark, the study re-ran two established ones on today’s frontier models: Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, and Gemini 3.5 Flash, each in its own native agent CLI. 

The tougher of the two, SusViBes, is effectively a graveyard: 200 real feature tasks inside large open-source repositories, each one built around a real vulnerability that a human already found, disclosed, and fixed. The agent is asked to build the feature. The question is whether it independently arrives at the protection the human fix contained, or digs the old bug back up. 

The results: 

• Functional success surged to 83–95% across the cohort — up from 44–61% a single model generation ago. Writing working code is nearly solved. 

• Secure-and-functional success reached only 24–36%. Across models, 65–75% of working patches resurrected the vulnerability the humans had put to rest. 

• The functional–security gap widened — in the Claude lineage, from 38 points to 63 points in one generation. 
  
  

The models know, but still ignore 

Here’s what makes this more concerning than a knowledge gap. These CVEs are public. Their advisories, their fix commits, their write-ups are all over the training data. The models have, in all likelihood, seen the fixes, and they resurrect the bugs anyway. 

The study’s failure audit makes this concrete. In the analyzed failures, agents named the exact required defense in their own threat model, then shipped the vulnerable code anyway.  

“Just prompt it to be secure” doesn’t work 

The study tested a ladder of increasingly expensive interventions: 

• A one-line “follow best security practices” reminder added just 1–8 points of security, depending on the model. 

• Maxing out reasoning effort added zero security in a targeted spot-check — and halved the number of working patches. 

• A dedicated threat-modeling step before coding lifted cumulative secure-and-functional success to 43–49%, at roughly 2x the token cost of writing the code alone. 

• Adding a post-hoc security review reached 47–56% — at roughly 2.5x the token cost. 

Even paying the model multiples of the original task to secure its own output, roughly half the tasks still shipped insecure. 

What this means for your pipeline 

One scoping note the researchers are careful about, and so are we: these benchmark tasks were selected because the vulnerability is the natural way to build the feature. On generic everyday code, the resurrection rate is likely lower. But that scoping is cold comfort: real codebases are full of exactly these features, because that’s where the CVEs came from in the first place. 

And this isn’t confined to the lab. Checkmarx’s own 2026 Future of AppSec report – a survey of 2,350 CISOs, AppSec managers, and developers across 14 countries – supports these findings:  

•  70% of developers say AI code generation created more vulnerabilities in their code in 2025.  

• AI-generated code already contributed to 25% of breaches, making it a top-four breach vector in its first year of tracking.  

• And the dose-response curve is unmistakable: organizations where 81–100% of code is AI-generated ship vulnerable code at 3.4x the rate of those at 1–20%.  

With nearly half (49%) of production code now AI-generated, this isn’t one zombie wandering out of a grave – it’s a horde of them. 

Read the full research 

The complete paper, including the per-CWE breakdown, the intervention cost analysis, and the full failure-mode taxonomy, is available here: 

Read the Full Research