A new benchmark shows that AI-assisted code edits can quietly make software less secure, even when the code still runs.
Researchers introduced WeSCE, a benchmark of 400 executable programs pulled from real-world code, to measure this "security drift." The programs span four common editing tasks: feature addition, feature removal, bug fixing, and refactoring. Crucially, the tasks describe only what the code should do, not how it should stay safe, mirroring how most developers actually write prompts. To score results, the team built a continuous risk model that combines multiple vulnerability signals into drift measures tracking overall risk, worst-case severity, and how vulnerabilities are distributed across a codebase.
The gap this fills is real. Most benchmarks for AI coding tools check whether generated code passes tests, not whether it opens a new SQL-injection path or widens an existing one. WeSCE targets exactly that blind spot: security requirements nobody bothered to state.
It won't settle the argument over whether AI coding assistants are net-safe or net-risky, but it gives that argument a shared yardstick instead of anecdotes.