There is. You read the standard, you implement the standard. And then you do an once-over over all time zones each year to check which standard they are following and if and when they are switching. Probably less than one competent engineer. But apparently, either MS does not have competent engineers or does not want to spend money on this. And hence they have a ton of egg on their faces. Again.

So? My comment was specifically about LLMs.

And that is how you do it if you have a clue. Not even expensive, just requires understanding.

It seems MS is regressing and getting worse and worse.

Apparently you did not understand what I wrote. Perfect code is NOT the goal. Redundant security is.

Yes. While I am still not impressed with the actual capabilities, the kicker at this time is the financial angle, in several dimensions. One is token cost. Another is that apparently nobody finds real revenue increases from LLM use. And even another, a bit more distant, is the cost for users to be able to switch providers (which is a regulatory requirement in some industries, at least in Europe).

On the plus-side, people that attack computer systems will likely be able to run their own local models as the task is very specialized and that will (hopefully) drag the software industry (kicking and screaming) to what all well established industries do: Redundancy to ensure properties even when something goes wrong.

That is why I am currently using it for that purpose.

May I suggest a few more names?
"Breadless bakeries" - They surely generate enough heat
"Sound distribution centers" - Apparently, these are really loud
"Landscape heaters" - See above
"Silicon stress test facilities" - Nothing wrong with testing stuff, right?

And there you are wrong. There is a bit more to making a game than creating a demonstrator. The software also has to survive in the real world. And LLMs cannot give you that.

Well, economics graduates like to use completely bad metrics as this one. For example, the Ad industry only measures whether you remember a brand. Whether you are in the "I will never buy from these fuckers again" corner does not get counted. Dumb people using dumb metrics.
Nothing new: "A good decision is based on insight and not on numbers" -- Plato.

Who is "Bellular"?

If you try to find the flaws as a defender, you have already lost. What you must do is prevent them or at least prevent exploitability. Test & fix as a paradigm is pretty much over in the security space. Sadly, that is all most coders can do.

Sounds like that is going to be much more expensive than using competent humans. And investing in secure design and implementation with resilience.

That will not help. Testing cannot fix this problem. As soon as the attacker tests just a bit differently, they will find vulnerabilities that the defenders did not find. The only solution is resilient security and that requires experts doing the software. No, slop will not work.

And fail. This is not about ROI. You seem to have missed that the attacker in the story was exceptionally incompetent. These moron-level attackers use LLMs to do things they cannot. Should get them to low expert level. And that is enough to break into many systems, because IT security sucks almost universally.