Broken access control
The server fails to enforce what a user may do, so they can do it anyway: open an admin page, change a role, act on data that isn't theirs. It tops the OWASP list.
Hiding a button isn't a control, because the route behind it still answers. Agents often write the visible part and test the happy path, and static scanners struggle with this class, because no line of code is wrong. The bug is a line that isn't there.
Say it to your agent
“Write a table test: every route against signed out, ordinary user and admin, with the expected status for each. Fail the build if a route is missing from the table, so the next one added can't be forgotten.”