Veracode's 2026 GenAI Code Security Report gives AI-generated code a security pass rate of 56%.
Last year's figure was 55%. Over the same period the models got substantially better at almost everything else.
The two numbers that matter together
Modern models produce syntactically correct code close to 100% of the time. They produce secure code 56% of the time.
Roughly 44% of code-generation tasks introduced a real vulnerability.
A model that always compiles and is safe half the time is not a partially reliable engineer. It is a tool that has learned the part of the job with immediate feedback — a compiler error is instant, unambiguous and everywhere in the training data — and not the part whose feedback arrives months later in an incident report.
There is no error message for an injection flaw. There is a breach, eventually, somewhere else.
Where it fails is the real finding
Broken out by vulnerability type, the results are not uniformly mediocre. They are excellent in some places and close to useless in others:
| Vulnerability type | Security pass rate |
|---|---|
| Cryptographic algorithms | 87% |
| SQL injection | 83% |
| Cross-site scripting | 15% |
| Log injection | 12% |
87% and 83% against 15% and 12%. That is not a model that is bad at security. It is a model that is good at the famous vulnerabilities and bad at the rest.
SQL injection has been the canonical example in every tutorial, framework guide and code review checklist for twenty-five years. Cryptography has strong, repeated, well-documented conventions. Cross-site scripting is just as old and just as serious, but the correct handling depends on output context in a way that resists a memorable rule — and log injection barely appears in the popular material at all.
The pattern fits what these systems are: the security knowledge in the training data, reproduced in proportion to how much of it there is.
The levers do not work
The obvious responses have been measured, and none of them move the number much:
- Reasoning models: 56%. Non-reasoning: 51%.
- Large models: 53%. Medium and small: 51% each.
- Coding-specialised models: 51%. General-purpose: 52% — the specialists are marginally worse.
- Best single model, GPT-5.5: 68%. More than half of those tested land between 50% and 53%.
Scale gives two points. Reasoning gives five. Specialising for code gives nothing. If this improved with the usual levers it would have improved already.
Why this lands now
Because in organisations that have adopted AI coding tools, AI now authors roughly half of all committed code.
Half the codebase, from a source that ships a vulnerability in about 44% of tasks, at a rate that has not improved in a year. Veracode notes that software vulnerabilities are now the top breach entry point at 31%, and that 82% of organisations are carrying security debt.
Put this next to the other half of the story. Broadcom pointed AI at Spring and took the count from 16 disclosed vulnerabilities in 2025 to over 200 this year. Anthropic is putting its most restricted model into defender tooling. An agent swarm found 266 vulnerabilities across 15 open-source projects.
The same technology is writing the bugs and finding them. Whether that nets out positive depends on a race between two rates, and this report is the first hard measurement of the writing side.
What to do
- Treat generated code as untrusted input until it has been through security testing. That is Veracode's own conclusion and it is the right one.
- Weight your review toward what the models are worst at. Output encoding and anything that reaches a log deserve more scrutiny than the parameterised query the model got right.
- Do not assume a newer or bigger model fixed it. The measured gain from scale is two points.
- Put scanning in the pipeline, not at the end. At half of committed code, manual review does not scale to the volume.
- Measure your own rate. An industry average is not your codebase, and this is checkable.
What is not established
- The exact model and task counts behind the aggregate are not on Veracode's own page.
- Language-by-language results. Not published there.
- Whether the 56% figure generalises beyond the specific task set used.
- How much human review catches before these defects reach a repository. The report measures the model's output, not the finished product.
