Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-24 · high
Same six apps, same assistant, but adding one security-requirements paragraph to the prompt dropped confirmed findings from 51 to 24.
Why now: The paper posted in August 2026, comparing a bare vibe-coding prompt against one with a single added security paragraph.
Researchers built six functionally distinct web apps twice each, using the same coding assistant and the same model version for every pair. One prompt in each pair carried an added security-requirements paragraph; the other didn't. Static analysis, dependency scanning, dynamic testing, and manual review together confirmed 75 of 85 candidate findings across both versions of all six apps, according to the arXiv paper.
The baseline prompts produced 51 confirmed findings. The security-aware prompts produced 24, and none of those 24 were rated Critical or High severity. Every one of the six app pairs showed the same drop.
But the single worst finding in the whole set, the highest-severity issue found anywhere, turned up only under manual testing. Static and dependency scanners missed it entirely. A prompt change doesn't replace a reviewer who knows what to look for.
The authors flag their own limits too: six apps, one generation each, one assistant, one model version. Nothing here says the same ratio holds at a different scale or with a different tool.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Earlier coverage
Both cover Critical, High; reported by the same outlet (arxiv.org); earlier Critical coverage from 2026-05-08.
Shared entity: Static / Same source domain / Shared topic / Earlier coverage
Both cover Static; reported by the same outlet (arxiv.org); overlapping topics (analysi, prompt).
Shared entity: Critical / Same source domain / Earlier coverage / Tension
Both cover Critical; reported by the same outlet (arxiv.org); earlier Critical coverage from 2026-03-22.
Shared entity: Static / Shared topic / Earlier coverage / Tension
Both cover Static; overlapping topics (prompt, section); earlier Static coverage from 2026-03-16.
Shared entity: Critical / Same source domain / Earlier coverage / Tension
Both cover Critical; reported by the same outlet (arxiv.org); earlier Critical coverage from 2026-02-17.
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (analysi, application, candidate); pushes against this story (against).
Shared entities / Earlier coverage
Both cover Critical, High; earlier Critical coverage from 2026-08-08.
Both cover Critical, High; earlier Critical coverage from 2026-02-28.