Five AI Coding Assistants All Ship Insecure Auth Code by Default — Only Iterative Reprompting Closes the Gap

arXiv 2607.23710·medium signalXBlueskyLinkedInCopy link

'The Illusion of Secure LLM Code' (arXiv 2607.23710, July 26) evaluates authentication systems generated by five prominent AI coding assistants using a bi-modal framework of static analysis plus dynamic penetration testing, mapped to NIST SP 800-63B, across four prompting strategies (Basic, Secure, NIST-Based, Reprompting). Functional and generically 'secure' prompts consistently omitted brute-force resistance, sound session management, and robust password handling; supplying explicit NIST context in a single shot improved compliance but remained structurally inadequate. Only forcing the model into an iterative contextual self-auditing loop produced defense-in-depth. The authors' conclusion is directly operational: enterprises must move from single-shot prompt engineering to continuous, standards-driven verification pipelines.