A 450-task benchmark built from real CVEs shows even the best AI coding agent writes code that's both working and secure only 25% of the time.