AI Writes Code, but Fails Security 44% of the Time

What Happened?

Veracode, a company specializing in application security, published its annual GenAI Code Security Report 2026, based on the analysis of over 100 generative AI models at four different points during the year. The report evaluates these models' ability to generate secure and compilable code, focusing on common vulnerabilities such as SQL injection, buffer overflow, and poor authentication handling. The main result: only 56% of AI-generated code passes standard security tests. This means 44% contains at least one vulnerability, a figure that has remained stable over the past year with no signs of significant improvement.

The report highlights that AI's ability to generate compilable code has notably improved, reaching nearly 100% in many models. However, security has not kept pace. The 56% pass rate has remained constant, suggesting that advances in code generation have not translated into security improvements. According to Veracode, the latest models also show no significant advantage in this regard over previous versions.

The study included models from various providers, such as OpenAI, Google, Anthropic, and Meta, evaluating both proprietary and open-source models. The methodology involved generating code for common development tasks (like authentication, database handling, and input processing) and then analyzing it with static and dynamic analysis tools. The results showed that the most frequent vulnerabilities are related to input validation, access control, and error handling.

Why Is This Important?

Generative AI is rapidly integrating into software development workflows. According to GitHub, over 40% of code in projects using Copilot is AI-generated. If that code has a 44% chance of containing security flaws, the potential impact is enormous. Companies adopting these tools without additional controls are significantly increasing their attack surface. A 2025 GitLab study found that organizations using AI code assistants report a 20% increase in security incidents related to generated code.

Moreover, the speed of code generation can create a false sense of productivity. A developer reviewing AI-generated code may overlook vulnerabilities if they trust the tool too much, a phenomenon known as "automation bias." This is especially dangerous in security-critical environments like fintech, healthcare, or infrastructure. For example, an SQL injection vulnerability in a banking application could expose the financial data of millions of users.

The Veracode report also notes that the lack of improvement in AI-generated code security over the past year is concerning, as it contrasts with rapid advances in other AI areas like text and image generation. This suggests that AI providers are not prioritizing security in their code models, possibly because current benchmarks do not penalize it enough.

From a historical perspective, this problem echoes the early days of open-source software, when mass adoption of libraries without security review led to widespread vulnerabilities like Heartbleed. In that case, the community responded with more rigorous analysis tools and review processes. A similar response is likely for AI-generated code.

Consequences and Recommendations

For development teams, the conclusion is clear: AI-generated code cannot be deployed without human review and automated security testing. Veracode recommends integrating static analysis (SAST) and dynamic analysis (DAST) tools into the CI/CD pipeline and treating AI code as if it came from a junior developer. This means every generated code snippet must pass the same quality and security checks as human-written code.

Additionally, companies should establish clear policies on AI use in development, including mandatory peer code reviews and developer training in identifying common vulnerabilities. Investment in application security testing (AST) tools is crucial, and the AST market is expected to grow 15% annually until 2030, driven by AI adoption.

At the industry level, regulators are expected to start requiring specific security audits for AI-generated code. The European Union, with its AI Act, is already moving in that direction. The AI Act classifies generative AI systems as "limited risk" but requires transparency and documentation. Future amendments are likely to include stricter security requirements for generated code. Companies that fail to adapt could face penalties or costly security breaches. For example, a breach in an AI system could result in fines of up to 6% of global revenue under GDPR if personal data is exposed.

Finally, AI providers must prioritize security in their models. In the meantime, developers should be aware that AI is a tool, not a replacement. Security training remains essential, and organizations should foster a "security by design" culture where AI is used as an assistant, not an autonomous author.

"AI-generated code is like a very fast intern: it produces a lot but needs constant supervision to avoid critical mistakes," the report notes.

In conclusion, the Veracode report is a wake-up call for the entire software industry. The promise of generative AI in development is real, but its adoption without proper precautions can have serious consequences. The combination of automated security tools, human review, and appropriate regulation will be key to harnessing AI's benefits without compromising security.