This exceptional report illustrates the promise and challenges of code-generation models. These powerful capabilities are being integrated into s/w development pipelines now. The authors highlight the need for better evaluation benchmarks to assess their ability to generate secure code.