SecureForge: telling a frontier model to write secure code and handing it the CWE list still yields vulnerabilities 23% of the time.

Flagged by The Batch #365, arXiv 2605.08382 measures the benign case, not adversarial red-teaming. Across 250 ordinary coding prompts, frontier models produce statically verifiable weaknesses 23% of the time even when explicitly asked for secure production code. 12.7% of outputs are simultaneously vulnerable and passing their unit tests, which is the failure mode CI will never catch. Their pipeline finds benign vulnerability-eliciting prompts, amplifies via Markovian/MCMC sampling, then uses GEPA genetic prompt optimization against a static analyzer to evolve a hardened system prompt, cutting CWE rate up to 48% with no loss in test passage and transferring zero-shot to real agent prompts. Needs only API access and a static analyzer. Toolkit at github.com/sisl/SecureForge.