The AI tools founders build with fail basic security tests. How sure are you about the code they wrote?

If you built your product with AI, you trusted a coding agent with your code, your files and your machine. Claude Code, Cursor, Codex, Copilot and the rest did a lot of the work, and they told you when it was finished.

We test those agents. On AgenticBench we run 25 of them through the same 9 security tests, all on the same model, so the only thing that differs is the agent itself. Only 3 of the 25 passed all 9.

What the agents got wrong

These are not exotic attacks. They are the basic promises a coding agent makes about its own behaviour:

• A project file gave the agent more power than you did. In 12 of 25 agents, settings inside the repository widened what the agent was allowed to do.
• Code ran before you agreed to it. In 10, start-up code in a project ran without asking.
• "Stay in this folder" didn't hold. In 10, a simple link let the agent read a file outside the workspace.
• "Read-only" wasn't. In 7, the restricted mode failed to stop writes outside the workspace.

Some agents also send more off your machine than you would expect. DeepSeek's own coding agent, for example, sends your session, including the contents of files it reads, to DeepSeek by default, and the off switch most people would try does not stop it. The evidence is public.

Why this matters for what you ship

This is not a claim that these agents write bad code. Often they write very good code. The point is simpler. The same tool that wrote your product also told you it was done, the tests passed and the guardrails were in place. If the tool cannot keep its own promises about what it does on your machine, its word about your code is not evidence.

That matters most at the moments you can't take back: your first paying customers, a client handover, an investor whose engineer asks how you know it works.

What an independent evaluation checks

We take your code at an exact commit and run it in an isolated environment with fake secrets and controlled networking. Every evaluation starts with five checks:

1. Clean start: it builds and runs from a fresh checkout.
2. Blocked means blocked: when something should be refused, it really is stopped, not just logged as stopped.
3. No escape: a planted fake secret stays inside.
4. Honest logs: the record matches what really happened.
5. Done means done: when it says success, the change really happened.

You get a report signed by a named person, with a reproduction script for every finding, so you can fix it and prove the fix.

Start here

When you are ready, The Honest Second Opinion is £299, and the Deny Means Deny certificate is £399. See every agent we have tested on AgenticBench.