675 security pull requests from coding agents: the flaws were regexes, shell strings and file paths
A 2026 study ran Semgrep over agent-written security PRs on popular GitHub repositories. What it found, what it can't tell you, and three checks to put at the top of your next review.
6 min read