Expert: James Wickett, CEO, DryRun Security DryRun Security tasked Claude Code (Sonnet 4.6), OpenAI Codex (GPT 5.2) and Google Gemini (2.5 Pro) with building FaMerAgen and Road Fury through a standard iterative pull-request workflow: a full codebase scan before development began, a scan on every pull request as it was submitted, and a final scan after all features were merged. The failures were not hallucinated APIs or broken syntax that a linter would catch. They were architectural omissions - access control never enforced, middleware never mounted, auth built for one protocol and not the next - which is why they survive the moment the code compiles. James Wickett, CEO of DryRun Security: "AI coding agents can produce working software at incredible speed, but security isn't part of their default thinking. In our usage and experience, AI coding agents often missed adding security components or created authentication logic flaws. These mistakes and gaps are exactly where attackers win." The report groups the findings into ten vulnerability categories that recurred consistently enough across agents and tasks to be treated as structural patterns. The most universal was broken access control, present in all three agents in both applications, primarily as unauthenticated endpoints on destructive and sensitive operations. Business logic failures appeared in the game app across all three: scores, balances and unlock states were accepted from the client without server-side validation. OAuth implementation failures appeared in the web app from all three, with missing state parameters and insecure account linking in every social login. WebSocket authentication was missing from every final game codebase - the agents built REST authentication middleware correctly and then did not wire it into the WebSocket upgrade handler. Rate limiting was defined in every codebase and connected to none. JWT secret management was weak across all three agents in the game app, where hardcoded fallback secrets mean an attacker can forge valid tokens without obtaining credentials. Where the agents landed differs, and the differences matter less than the baseline. The game app's baseline scan found zero issues; the final scans found eight in Claude's version, seven in Gemini's and six in Codex's. The web app's baseline found nine issues; final totals were 13 for Claude, 11 for Gemini and eight for Codex. Codex produced the fewest remaining vulnerabilities in both apps, but a temporary token bypass persisted in its final codebase. Claude introduced a 2FA-disable bypass not found in the other agents' work, and in the game app carried an insecure direct object reference from pull request 2 and an unauthenticated destructive endpoint from pull request 1 all the way to the end of the project - the longest-lived unresolved findings in the study. Gemini retained OAuth CSRF and invite-bypass issues through to the final scan and, in the game app, introduced the most issues overall and finished with the most high-severity findings. No agent was clean, and no agent was asked to be: they optimise for task completion unless the system around them is built to optimise for safety. The practical takeaway is that agent velocity without governance is operational debt, and that this is a process design problem rather than a model upgrade problem. Scan every pull request, not just pre-release branches. Run full codebase scans periodically, because per-PR scans miss cross-file compounding. Threat-model before the agent writes code. Enforce deterministic gates - tests, linters, auth checks and policy checks. Require human approval before merge on high-risk scopes such as authentication, billing and data deletion. Explicitly test WebSocket and REST auth parity, which failed in every agent's work. Ban hardcoded JWT fallbacks and source secrets from a secure store. Reading "the code compiles" as "the system is secure" is precisely the error this study measures. Source: https://www.helpnetsecurity.com/2026/03/13/claude-code-openai-codex-google-gemini-ai-coding-agent-security/