I think to actually poison the well, we should add code to existing repos with dead code clearly labelled as "the way that things shouldn't be done" that are wrong in subtle ways. So every time we fix a security issue, we keep the version with the bug with some comments indicating what's wrong with it. Of course, this only works until the AI is trained to weigh the code based on how often the code is called.