The security of AI-generated code has reached a standstill at 56%.

      AI is now capable of generating compilable code almost consistently. However, nearly half of this code contains security vulnerabilities, a situation that has not improved over the past year. This key finding comes from Veracode’s 2026 GenAI Code Security Report, which evaluated over 100 models across four different assessments. The average security pass rate is currently at 56%, nearly the same as the starting point of 55%.

      Consider this alongside another statistic from the report: AI now generates about half of all committed code. While the failure rate has remained stable, the amount of code produced has surged. Syntax issues have been resolved, but security problems persist.

      The disparity is evident. Without security-specific prompts, models produce code that compiles almost 100% of the time, yet they fail on security aspects almost 44% of the time, introducing vulnerabilities from the OWASP Top 10.

      “Models may achieve near-perfect syntactic quality, but they still fall short on almost half of the tasks requiring security,” stated Chris Wysopal, Veracode’s co-founder and chief security evangelist. “This statistic should raise alarm bells for any organization.”

      It's important to note that the tests were conducted on raw models without agents, guardrails, or human oversight. In a practical environment, these elements offer a layer of protection. Thus, the 56% rate indicates how many flaws the models generate, not how many errors make it into production.

      Three assumptions the data challenges

      The report debunks some familiar assumptions.

      1. Models designed specifically for coding aren’t necessarily safer. Their average score was 51%, slightly lower than the 52% score of general-purpose models. Opting for a coding-optimized tool does not significantly reduce risk.

      2. Size does not contribute to better security outcomes. Large models averaged 53%, while medium and small models both scored 51%. Increasing model size does not bridge the gap.

      3. The only factor that showed improvement was reasoning models, which averaged 56% compared to 51% for other types. These additional reasoning steps seem to function like an internal code review prior to delivery.

      The leaderboard and its implications

      OpenAI’s GPT-5.5 leads this assessment with a score of 68%. Six out of the eleven models tested fall between 50% and 53%, with Alibaba’s Qwen3.7-max at the bottom with a score of 50%, producing vulnerabilities in every second output.

      Even the top performer presents concerns. At 68%, GPT-5.5 remains unsuccessful in almost one-third of security tasks, and it has regressed since last year’s leader, which scored 72%. The highest scoring models have declined overall.

      The rankings also reflect a global shift. Moonshot’s Kimi-K2.6 and Xiaomi’s MiMo-V2.5 now outperform several Western models. This adds another factor for procurement teams to consider.

      Identifying the vulnerabilities

      The average figures mask significant variations. By programming language, Python had a pass rate of 63%, whereas Java only achieved 30%. Java emerges as the most vulnerable language, though it shows a clear upward trend.

      The disparity also varies by vulnerability type. Models performed reasonably well in handling SQL injection and weak cryptography, scoring 83% and 87%, respectively. In contrast, they fared poorly on cross-site scripting and log injection, scoring only 15% and 12%. These issues are significant and the models struggle to address them.

      The volume concern

      This issue would be less impactful if AI accounted for only a small portion of the codebase, but that’s no longer the case. The failure rate seemed manageable when AI was only a trial. Now, it is involved in half of all code a team produces at a pace far outpacing security teams’ ability to manually check.

      This forms a troubling foundation beneath reports of coding platforms leaking live projects and increasing agent attacks across the industry. Furthermore, as one security founder pointed out, AI has subtly expanded the overall attack surface. This complicates the belief that AI can justify its costs, especially considering how much enterprise AI remains in developmental stages.

      Veracode has a vested interest in raising awareness since it offers tools aimed at identifying and rectifying these issues. The report was published a week before the Black Hat conference. Nevertheless, the underlying data serves as a straightforward benchmark, consistently yielding the same results over the past year, and it casts a negative light on all involved parties.

      Wysopal, however, isn’t advocating for restricting access to these models. “The solution isn’t to limit access; it’s to prioritize transparent, evidence-based safety,” he remarked, previously defending the availability of powerful models like Claude Fable and Mythos to developers. “Scan it, fix it, and never ship it without oversight.”

      His final message is crucial. Until models can reason about security in the same way they do syntax, it is the safety mechanisms within the workflow that