Five AI coding assistants all ship insecure auth by default.

arXiv 2607.23710 evaluated authentication systems from five prominent assistants against NIST SP 800-63B using static analysis plus dynamic pentesting across four prompting strategies. Functional and generically "secure" prompts consistently omitted brute-force resistance, sound session management, and robust password handling. Supplying explicit NIST context in one shot improved compliance but stayed structurally inadequate. Only an iterative self-auditing loop produced defense in depth. (arXiv 2607.23710)