The Next Model Won’t Fix This: Four AppSec Imperatives From Black Hat USA 2026
Brief
Black Hat USA 2026 didn’t introduce the AI security problem, but made it clear how fast thatproblem is becoming operational.
An independent study initiated and funded by Checkmarx helps explain why. On real-world repository tasks, frontier models produced working code 83% to 95% of the time, but only 24% to 36% of their solutions were both functional and secure.
Adding a post-generation security review improved the secure-and-functional rate to 47% to 56%, but a substantial gap still remains between code that works and code that can be trusted.
That gap changes the role that application security must play. When AI is generating the code, the signals that teams have typically trusted stop working: code that compiles, passes a functional test, or comes with a confident explanation cannot be assumed to be secure.