A new independent study commissioned by application security firm Checkmarx and conducted by Ilya Kabanov of The Weather Report Inc. found that while AI coding assistants write working code 90% of the time, they secure it only a third as often. The study, titled *Capability Without Security: Measuring the Functionality-Security Gap in AI-Generated Code*, tested four leading AI coding models—Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, and Gemini 3.5 Flash—against 200 real-world coding tasks. The newest models solved the coding task correctly 83–95% of the time, a sharp jump from 44–61% just one generation ago. However, the share of solutions that were both correct and free of the specific security flaw stayed flat at 24–36%. Of the code that worked, roughly two-thirds to three-quarters still carried the exact vulnerability it should have avoided. The study re-ran two established benchmarks, CyberSecEval and SusVibes, and noted that this held even when vulnerabilities were publicly known before the models were trained. In one test, the model that wrote the most correct code ranked last on security.