An interesting point is that if you ask AI to security audit a codebase it can find the vulnerabilities. But the AI "forget security" when writing new features. This is probably caused by training data and RL.