---
title: 'In the News: October 23, 2026 (Extra 3)'
description: "The best coding agent on Endor Labs' security benchmark passes the security tests on 37.4% of tasks, against 87.2% on functional tests."
canonical_url: 'https://darkfactory.dev/news/2026-10-23-extra-3'
markdown_url: 'https://darkfactory.dev/news/2026-10-23-extra-3.md'
collection: news
date_published: '2026-10-23T23:25:00-04:00'
date_modified: '2026-10-23T23:25:00-04:00'
---

# In the News: October 23, 2026 (Extra 3)


One item cleared the bar this cycle: a vendor-run leaderboard that scores coding agents on whether their code works and whether it is also secure. The gap between the two is large for every combination listed.

## 1. The best coding agent passes the security tests on 37.4% of tasks

**[AI Coding Agent Security Benchmark](https://www.endorlabs.com/research/ai-code-security-benchmark)** · Endor Labs · Agent Security League leaderboard, read October 23, 2026

The Agent Security League scores coding agents on 200 tasks drawn from 108 open-source Python projects covering 77 vulnerability classes, and extends Carnegie Mellon's SusVibes benchmark. A result counts as functional if it passes the task's functional tests, and as secure only if it also passes the security tests. As listed, Claude Code with Claude Fable 5.1 leads at 87.2% functional and 37.4% secure (run dated 2026-09-04). Codex with GPT-6 Astra follows at 82.1% and 34.6% (2026-09-09), then Codex with GPT-6.1 Sol at 77.7% and 34.1% (2026-10-01). The newest listed run, Cursor with Gemini 4 Argon (2026-10-16), scores 78.8% and 29.0%. Across all 33 agent and model combinations, none passes the security tests on more than 37.4% of tasks.

These are Endor Labs' own runs. In a June 10 post, the company said earlier scores had been inflated by scoring edge cases and by agents recovering existing fixes, from a fixed copy left in the workspace or from training recall. After re-evaluation, Claude Code with Claude Opus 4.8 fell from 23.5% to 14.5% secure. The leaderboard page does not say how the newer rows were checked for the same problems.

**Why it matters:** For the top combination, about 50 percentage points of tasks pass the functional tests but not the security tests. A verification loop that runs only functional tests would pass that code, so the security checks need to be in the loop explicitly.