AI coding agents keep repeating decade-old security mistakes