AI Writes Half the Code but Still Fails Security Tests 44% of the Time

Veracode's 2026 GenAI Code Security Report: A Persistent 44% Failure Rate

AI models can now write compilable code with near-perfect syntax on every attempt, but they still ship a security vulnerability almost half the time. That's the central finding of Veracode's 2026 GenAI Code Security Report, which ran over 100 models through a standardized security benchmark across four snapshots over the past year.

The average security pass rate sits at 56%, essentially flat from the 55% recorded a year ago. The stubborn number becomes more alarming against another data point: AI now contributes roughly half of all committed code in many organizations. Syntax is solved, but security has not improved at all while the volume of AI-generated code has ballooned.

When prompted without specific security instructions, models generate compilable code 100% of the time, yet they fail on nearly 44% of security tasks by introducing a vulnerability from the OWASP Top 10. Chris Wysopal, Veracode's co-founder and chief security evangelist, called the figure “a red flag for any organization.” The tests were performed on raw model output, without agents, guardrails, or human review — extra layers that would reduce the risk in real-world pipelines, but the core failure rate remains the baseline that teams must contend with.

The report dismantles several comfortable beliefs. Models purpose-built for coding fared no better than general-purpose ones (51% vs. 52%), and larger model sizes barely budged the number (large models 53%, medium and small both 51%). Only reasoning models showed a modest advantage, averaging 56% against 51% for the rest, suggesting that the extra chain-of-thought steps act like an internal code review before the answer lands.

Why the Stubborn Security Gap Matters as AI Output Volume Explodes

The Failure Rate That Hasn't Budged in a Year

The persistence of the 44% vulnerability rate is the story's most sobering thread. While AI has shifted from an experimental toy to a production tool writing half of the code, the underlying security flaw rate remains unchanged. This means that as AI's share of the codebase grows, the absolute number of vulnerabilities introduced scales linearly — a volume no security team can manually review. The report serves as a measured floor beneath the anecdotes of vibe-coding platforms leaking projects and agent-based attacks proliferating.

Language and Vulnerability Splits Are Stark

Averages mask sharp divides. By language, Python passed 63% of the time, far ahead of Java's 30% — making Java the riskiest language for AI-generated code, though it is the only one on a clear upward trajectory. By vulnerability type, the spread is even wider: models handle SQL injection and weak cryptography reasonably well (83% and 87% pass rates, respectively), but collapse on cross-site scripting (15%) and log injection (12%). These are not niche issues; they represent widely exploited attack vectors that models barely register.

The Leaderboard Offers Cold Comfort

OpenAI's GPT-5.5 topped this round at 68%, but that still means it fails almost one security task in three. Worse, it's a step backwards from last year's leader, which scored 72%. Six of the eleven models tested cluster between 50% and 53%, with Alibaba's Qwen3.7-max last at an even 50% — shipping a vulnerability every other output. The globalisation of the leaderboard, with Moonshot's Kimi-K2.6 and Xiaomi's MiMo-V2.5 outscoring several Western models, adds a provenance dimension for procurement teams to weigh.

The Volume Problem Reshapes the Attack Surface

When AI wrote a sliver of the codebase, a 44% failure rate felt survivable. Now that it runs across half of everything teams ship, the attack surface has quietly expanded. The promise that AI pays for itself becomes harder to justify when so much enterprise AI-generated code still carries latent vulnerabilities. As one security founder argued, the entire attack surface has been moved. While Veracode has a commercial interest in sounding the alarm — it sells scanning tools — the like-for-like benchmark data over a year is not flattering to any model provider. Wysopal insists the answer isn't restricting access but enforcing transparent, evidence-based safety: “Scan it, fix it, and never ship it blind.”

What Development and Security Teams Should Do Right Now

• Automate scanning of all AI-generated code. The 44% baseline vulnerability rate means manual review is impossible at scale. Integrate static analysis and security testing into CI/CD pipelines so no AI-generated code reaches production unchecked.
• Treat Java as a high-risk language. With a 30% pass rate, Java code from AI models demands additional scrutiny. Schedule deeper manual reviews or dedicated security fuzzing for Java outputs, especially in enterprise backends.
• Reasoning models are a small edge, not a silver bullet. The 5-percentage-point advantage of reasoning models (56% vs. 51%) is helpful but still leaves a huge gap. Do not rely on model selection alone; use it as one layer in a defense-in-depth approach.
• Zero in on cross-site scripting and log injection. These vulnerabilities are missed 85% and 88% of the time, respectively. Teams should run targeted scans for these flaws on all AI-generated web-facing and logging code, and establish escape hatch processes when the code touches user input.
• Re-evaluate procurement criteria. With varied performance across models and a shifting leaderboard, proof-of-concept testing on your own codebase — not just published scores — should drive model selection. Note that last year's pacesetter at 72% has been replaced by a top score of 68%, so vendor promises of rapid improvement need data to back them up.