A poor design decision in OpenCode configuration handling is interesting, but not directly relevant to the question.

Assuming the question is whether not reviewing generated code is likely to create vulnerabilities despite SOTA models having audited the implementation.

Here it seems to have been a design choice, rather than an implementation mistake. I do not know what models were used and whether a review or audit has been done.

We are basically back at a vague the AI failed.

And sure, this happens, but there are some strong claims I'm reading here that are imo not evident:

- not reviewing implementation is foolish

- doing so will result in a flood of insecure software

- more AI cannot fix this

--

My arguments on each point:

- depends on risk tolerance, attack surface, error rate

- depends on actual performance of the proper setup I described on typical tasks, compared to the average engineer

- more AI can fix this, provided the audits become accurate enough to identify vulnerabilities with eg. 99.9% reliability

--

Are you sure that such accuracy for auditing is impossible, and will remain impossible in the future?