AI Code Security Stuck at 56% Pass Rate Despite Smarter Models

The number that won't move

AI models keep getting better at writing code. They are not getting much better at writing secure code. That is the central finding of Veracode's 2026 GenAI Code Security Report, which puts the average security pass rate across the models it tested at 56%, a one-point gain over the 55% recorded in its first report 4. Put the other way, roughly 44% of code generation tasks produced output containing a known vulnerability 4.

The research program has run across four testing snapshots and tracked more than 100 large language models 3. Its test is narrow by design. When a model writes code without being explicitly told to make it secure, does the result pass a standard security check 3? For close to half the tasks, it does not.

The Cloud Security Alliance, citing Veracode's earlier cycles, describes the same plateau. Its figure is that 45% of samples introduce OWASP Top 10 vulnerabilities, with no meaningful improvement from 2025 into early 2026 despite vendor claims of progress 1. The small gap between 45% and 44% reflects different reporting windows. Both sources describe the same flat trend line.

Syntax solved, security not

Veracode's framing is that modern models produce syntactically correct code nearly 100% of the time, so syntax is effectively a solved problem 4. Secure coding has not followed that curve. The firm warns that this fluency can create false confidence: code that compiles, runs and looks tidy can still carry exploitable weaknesses into production 4.

Model choice helps, but only so much. GPT-5.5 led Veracode's rankings at 68% 4. OpenAI released GPT-5.5 on April 23, 2026, promoting stronger agentic coding 5, and Anthropic is pitching Claude Opus 4.7 for long-running coding work 5. Even the top performer still fails roughly a third of security-sensitive tasks. The flagship releases are clearly better coders by many measures. On security, the improvement shows up as incremental gains at the top while the field average stays put.

The CVEs are already arriving

Other data suggests the problem has moved past benchmarks. Georgia Tech's Vibe Security Radar project counted 35 CVEs in March 2026 alone that were directly attributable to AI coding tools, and its researchers estimate the true number across open source is five to ten times higher 1. Lock.pub, drawing on the same research, reports a cumulative tally of 74 AI-linked CVEs by March 2026. It attributes 27 to Claude Code, 4 to GitHub Copilot and 2 to Devin 2.

Those per-tool counts need careful reading. They likely reflect how widely each tool is used and how easily its output can be traced, not just how unsafe each tool is. The sources do not normalize for adoption, so the figures should not be read as a safety ranking.

Lock.pub also lists the recurring failure modes [2]:

• String concatenation instead of parameterized queries, which opens the door to SQL injection
• Missing input sanitization, which enables cross-site scripting
• Unvalidated file paths
• Deserialization of untrusted data
• Placeholder credentials that look real
• Deprecated hashing such as MD5 and SHA1

It also cites a Stanford study finding that developers using AI assistants introduced more vulnerabilities than those coding without them 2.

Volume is the multiplier

The most consequential figure may be about throughput, not quality. Research across Fortune 50 enterprises, cited by the Cloud Security Alliance, found that AI-assisted developers commit code three to four times faster than their peers but generate security findings at ten times the rate 1. The CSA calls the result security debt that builds up faster than teams can pay it down 1. Veracode makes a related point: security performance has stayed flat while the amount of AI-generated code entering pipelines has surged 4.

This is the real story behind the 56% figure. A flat failure rate applied to a fast-growing volume of code means the absolute number of flaws keeps climbing, even if no individual model gets worse.

What to take from it

The sources agree on the direction. The disagreements are minor and mostly about how to slice the data. My reading is that model vendors are optimizing for capability benchmarks where security is not the main target, and the next model release is unlikely to fix this on its own.

For engineering teams, the practical response follows from Veracode's own methodology, which measured output when no security instruction was given 3. That points to a few steps:

• Write security requirements into prompts explicitly.
• Run static analysis on every AI-generated change.
• Track remediation capacity against commit velocity.

If output grows several-fold while review capacity stays the same, the debt the CSA describes is not a forecast. It is already on the books.