AI-generated Code Security Stalls at 56%
Veracode's 2026 GenAI Code Security Report reveals a concerning trend: despite AI writing half of all committed code, security pass rates remain stagnant at 56%, down from 55% the previous year.
Key Findings:
-
AI excels in syntax but struggles with security: AI models can generate compilable code almost perfectly (90-100% success rate), yet they still introduce a vulnerability in nearly 44% of their code outputs, based on OWASP Top 10 criteria.
-
No improvement despite increased coding volume: As AI takes over more code generation, the number of security flaws it introduces remains constant.
-
Reasoning matters: The report finds that models with built-in reasoning steps improve security performance, achieving an average pass rate of 56% compared to 51% for other models.
-
Global competition heats up: OpenAI's GPT-5.5 leads the pack with a 68% success rate, but several Chinese models like Kimi-K2.6 and MiMo-V2.5 outperform some Western models, highlighting growing global competition in AI code security.
Language and vulnerability types also play a role:
- Python demonstrates better security performance (63%) than Java (30%).
- Models struggle with cross-site scripting (15%) and log injection (12%), indicating specific areas for improvement.