The Complexity Paradox

A series drawn from my MSc dissertation on the security of LLM-generated code. One hundred tasks, built three ways — vibe coded, security-aware prompted, and through an agentic workflow with a reviewer agent — and the finding that gives the series its name: the simple tasks produced nine times more vulnerabilities per line of code than the complex ones.

4 October 2026 Architecture beats vigilance The same plain vibe-coding prompts, passed through a supervisor, a coder and a security reviewer. Vulnerability density fell 77% against baseline, two classes of flaw disappeared entirely, and the nine-times complexity gap all but closed. Security · Architecture 12 September 2026 Security expertise still matters Same model, same tasks, same baseline prompts - the only difference was a developer who spelled out the security requirements. Vulnerability density fell by 60%, and the share of applications carrying a critical or high-severity flaw fell from 78% to 44%. Security · Expertise 31 August 2026 The Complexity Paradox The simple tasks produced the worst code. One hundred tasks, and the simplest carried 9x the vulnerability density of the complex, which makes task simplicity a poor proxy for security risk. Security · Complexity