Veracode finds AI code still stuck on security

What this is about

Veracode published a new GenAI Code Security Report on July 28, 2026. The key number is uncomfortable: AI-generated code reportedly reaches only a 56 percent security pass rate. In other words, in a significant share of tested tasks, models produced code that may look functional but contains known security problems.

This matters because AI coding assistants are no longer toys for early adopters. They sit inside IDEs, pull-request workflows and internal developer platforms. If a model writes code faster while security does not improve at the same pace, it also scales security debt faster.

What the report actually does

Veracode evaluates AI-generated code with a repeatable testing setup. In the methodology described in spring 2026, the company uses 80 coding tasks across Java, JavaScript, C# and Python. The tests cover common weakness classes such as SQL injection, cross-site scripting, log injection and insecure cryptography.

The claim is not that every model is dangerous or that AI code is useless. The sharper claim is that functional correctness and security correctness are diverging. According to Veracode, modern models do well on syntax and runnable code, but the security pass rate remains around 55 to 56 percent.

Why it matters

For developers, the finding is practical. An AI assistant can quickly generate a login route, a parser or an API function from a task description. That saves time. But a security flaw in exactly that function can later expose data, make logs manipulable or leave web interfaces open to cross-site scripting.

The cultural effect is especially tricky. If teams treat AI suggestions like ordinary code, they can pass through reviews too easily. A human often reads plausible code faster than they truly verify it. That creates a new kind of technical debt: not just unfinished code, but quickly generated code with invisible security assumptions.

In plain language

Imagine a machine gives you ten finished house keys every morning. Eight look perfect, but two open not only your door, but also your neighbor’s back door. The problem is not that the machine is useless. The problem is that every key has to be tested before it is handed out.

That is how AI code works. It can speed up work, but it does not replace checking whether inputs are sanitized, secrets are protected and permissions are properly limited.

A practical example

A team lets a coding assistant generate 40 small backend functions per week. If 56 percent pass the security test, roughly 18 functions remain that need closer review or repair. Even if only one in five of those reaches production, a measurable risk pile builds up over months.

A realistic control process would be: every AI-touched pull request gets SAST, dependency scanning and a short marker in the review. For functions handling user input, reviewers also check data flow, encoding and logging. That does not slow every commit to a crawl, but it makes visible where AI helped and where humans need to look harder.

Scope and limits

First, Veracode is itself an application security vendor. The numbers are useful, but they should be complemented by independent benchmarks and a team’s own measurements.

Second, the test setup reflects typical tasks, but not every real codebase. A team with good instructions, security templates and automated checks can do better than a raw prompt with no security context.

Third, a pass rate is not a complete risk measure. One critical flaw can be worse than ten harmless warnings. Teams need to assess severity, reachability and real usage separately.

SEO & GEO keywords

Veracode GenAI Code Security Report, AI code, AI-generated code security, secure coding, SAST, cross-site scripting, log injection, SQL injection, AppSec, developer tools, software security, coding assistants