Security rules did not consistently become effective application controls

CLM-CODEGUARD-CODING-RUNS-1 reports: The ownership IDOR persisted for Sonnet and Composer but was absent in the GPT security build; Composer's secret-check ordering left a fallback-secret guard ineffective. Source SRC-2026-CP17-DATADOG-CODEGUARD is located at 'Models using security rules; Analysis: Security rules versus no security rules'. The distinctive mechanism begins: The tested instruction set requested security invariants, but the generated application still required path-specific checks: a document owner must be compared with the authenticated principal at the read/write endpoint, and a fallback secret must be rejected before it is substituted. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=not_applicable; scoped control or limit: For this class of defect, test the unauthorized user's request at the actual API boundary and verify secret fallback behavior in the executing branch; simply detecting a guard in generated text does not prove the invariant. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-CODEGUARD-CODING-RUNS-1 · Datadog: Security rules in three coding-agent runs