New DryRun Security Research: Anthropic’s Claude Generates the Most Unresolved Security Flaws in AI-Built Applications

87% of pull requests (26 of 30) introduced at least one vulnerability and DryRun identified 143 security issues across 38 scans. Anthropic’s Claude produced the highest number of unresolved high-severity flaws in the final applications, Codex finished with the fewest and stronger remediation behavior, and Gemini removed some early issues but still ended with high-severity findings. No agent produced a fully secure application; four authentication-related weaknesses (insecure JWT handling, lack of brute-force protections, token replay exposure, and insecure refresh-token cookie defaults) appeared in every final codebase. This highlights material security and operational risk from using AI coding agents in production without additional security controls.

Analysis

AI-assisted development is creating a persistent, structural demand shock for application-layer security rather than a one-off cleanup cycle. Expect engineering orgs to shift budget from generic observability into DevSecOps primitives (secure-by-default token management, automated brute‑force throttling, replay protection) within 3–12 months as teams standardize guardrails for agentic workflows.

Cloud vendors and identity platforms are positioned to capture the largest share of that spend: embedding secure CI/CD templates, managed key/token services, and runtime policy enforcement into hosted developer environments is the fastest path to enterprise buy‑in. That creates a two-tier market where players with pre-integrated, low-friction controls win adoption faster than best‑of‑breed point products that require heavy customization.

Insurance and regulatory channels are the wildcards that can amplify demand — a single publicized breach linked to AI-generated code would force rapid underwriting changes and require vendors to support auditable developer telemetry; conversely, clear regulatory guidance (or vendor-provided secure defaults) could shorten the window for security vendors to monetize new workflows. Time horizons: immediate remediation and tool adoption (weeks–months), commercial re‑rating of security vendors (3–12 months), and regulatory/insurance repricing (6–24 months).

For portfolio construction, prioritize firms with (1) deep integration into developer toolchains (IDP/CI systems, IDE plugins), (2) identity/token management offerings, or (3) strong channel/managed service footprints to scale remediation across large enterprises. Be wary of frothy, small-cap “AI dev” plays that lack enterprise hooks — they face tougher sales cycles as security becomes a procurement gate. Trade sizing should account for binary breach/regulatory catalysts that can move valuations >20% in a single quarter.

Key Decisions for Investors

• Buy PANW (Palo Alto Networks) stock or buy the PANW 9–12 month call spread (debit spread using ~15–25% OTM strikes). Rationale: incumbent with integrated cloud security and Prisma/Unit42 distribution; reward: 20–35% upside if enterprise accelerate DevSecOps spend in 6–12 months; risk: 10–15% downside if macro/software spend weakens or vendors deliver free defaults.
• Long CRWD (CrowdStrike) 6–12 month calls (or 1/2 position in equity + calls). Rationale: strong telemetry and ability to upsell runtime app protection; reward: 25–40% on accelerated endpoint-to-app security adoption; risk: crowded valuation and execution sensitivity — cap losses to option premium or 12% equity stop.
• Buy OKTA (Okta) 6–9 month calls sized as a tactical hedge against identity/token risk for a multi-strategy book. Rationale: systemic token/JWT issues increase demand for federated identity and refresh-token controls; reward: 30–50% if identity becomes procurement priority; risk: execution/competition from cloud providers — limit to option premium.
• Avoid/underweight small-cap AI dev-assistant pure-plays without enterprise integrations; instead implement a pair: long ZS (Zscaler) or PANW and short a select small-cap AI tools name (size 0.25–0.5x) to reduce beta. Rationale: market will rotate from productivity narratives to security governance; reward: relative outperformance if security re-rating materializes; risk: pair may underperform in a broad tech rally — keep small relative size.