Models introduced a known security flaw in 45% of tested generation tasks
The Veracode 2025 GenAI Code Security Report found that models introduced a known security flaw in 45% of tested generation tasks across more than 100 large language models and 80 coding tasks. The pattern held regardless of model size or recency. Its July 2026 report shows that functional progress still has not produced consistently secure code. This brief keeps the baseline and the current result together.
What the research shows
Across more than 100 models and 80 tasks, models introduced a known security flaw in 45% of generation tasks.
August 2026 update
CurrentThe Veracode 2026 GenAI Code Security Report found only modest movement. GPT-5.5 led the Summer 2026 dataset with a 68% security pass rate, while six of the eleven tested models sat between 50% and 53%.
Models built specifically for coding averaged a 51% pass rate. General purpose models averaged 52%. The 2025 baseline below remains useful because the testing framework is consistent. The newer result changes the model names, not the need for security review.
The headline figure comes from the Veracode 2025 GenAI Code Security Report. In 45% of generation tasks, the model introduced a known security flaw. The research covered more than 100 large language models and 80 coding tasks (coverage via Help Net Security).
The failures were not evenly spread. AI models failed to defend against cross-site scripting in about 86% of cases and log injection in about 88% of cases, according to the same research.
The most uncomfortable finding is what did not change. Veracode reports that newer and larger models were not more secure than older ones, pointing to a structural problem in how AI generates code, not a limitation the next release will quietly fix. You cannot wait out this risk by upgrading to a bigger model.
Vulnerable versus clean samples
Veracode 2025across more than 100 models and 80 tasks
Where AI code fails most
Veracode 2025, share of cases failing to defendThe verified numbers
Sourced- 45% of generation tasks. The model introduced a known security flaw across more than 100 models and 80 tasks (Veracode 2025).
- ~86% cross-site scripting. Share of cases where AI models failed to defend against XSS (Veracode).
- ~88% log injection. Share of cases where AI models failed to defend against log injection (Veracode).
- No size advantage. Newer and larger models were not more secure than older ones (Veracode).
Where the data leaks
AI assisted commits leaked secrets at roughly double the baseline rate.
Vulnerable logic is one risk. Secrets also ship with the code. GitGuardian's State of Secrets Sprawl report found that AI assisted commits leaked secrets at roughly double the baseline rate, about 3.2% compared with about 1.5% across public commits.
Hardcoded API keys, tokens and credentials are exactly the kind of thing an AI assistant will helpfully write inline when it is moving fast and you are not watching closely.
The risk compounds in codebases that already have problems. Snyk found that GitHub Copilot can replicate and amplify vulnerabilities that already exist in a codebase. Existing security debt makes AI assisted output less secure, not more.
Secret-leak rate in commits
GitGuardianTwo ways vibe coded apps bleed
Sourced- Leaked secrets, about 2x. AI assisted commits leaked secrets at about 3.2% versus about 1.5% baseline (GitGuardian).
Why AI generated code is insecure
A model generates code from patterns it has seen. It has no understanding of security.
A language model predicts the next plausible token based on the vast amount of public code it was trained on. Plenty of that public code is insecure, so the model reproduces insecure patterns confidently and fluently. It is optimising for code that looks right, not code that is safe. That is why the finding that bigger models do not help makes sense. Scaling the same approach scales the same blind spot.
The human side matters just as much. Researchers at Stanford found that developers using AI assistants wrote less secure code, yet were more likely to believe their code was secure. That false confidence is the dangerous part. Fluent, well formatted output reads as trustworthy, so the review step that would have caught the flaw gets skipped. The OWASP Top 10 for LLM Applications maps the categories worth checking for.
The root causes
Why- Pattern, not understanding. Models reproduce patterns from training data, including insecure ones, with no model of security.
- Scale does not fix it. Newer and larger models were not more secure, which signals a structural cause (Veracode).
- False confidence. Developers with AI assistants wrote less secure code yet thought it was more secure (Stanford).
- A known taxonomy. OWASP maintains a Top 10 for LLM Applications as the reference framework for these risks.
What it means for your business
Vibe coding is useful, but it cannot be the last step before you ship.
None of this means you should stop building with AI. It means the output needs a security review before it reaches production, the same way you would review code from a fast junior developer who never went to a security class. If nearly half of AI generated code carries a flaw and secrets leak at double the rate, the cost of skipping review is a breach, a leaked credential, or a customer data incident you find out about the hard way.
The practical answer is a review gate. Get the code audited against a known framework, fix what the audit finds, and put a repeatable process around AI usage so the next sprint is safe by default.
For the attacker side of the same problem, see our review of AI enabled cyber attacks and the 2026 evidence.
What to do about it
Action- Review before you ship. Run a free Vibe Scan
- Audit what already shipped. Get a vibe code audit
- Fix and harden the app. Fix my AI app
- Lock down the process. AI security
- Build safely next time. Build with AI
Frequently asked questions
The Veracode 2025 GenAI Code Security Report found that models introduced a known security flaw in 45% of tested generation tasks across more than 100 large language models and 80 coding tasks. The failures concentrated in common categories. AI models failed to defend against cross site scripting in about 86% of cases and log injection in about 88% of cases.
Every number, cited
Act on the evidence