Veracode Finds AI Code Security Stalled at 56%
Veracode's July 28 GenAI Code Security Report found that more than 100 models averaged a 56% security pass rate, little changed from 2025, even as syntax pass rates approached 100%. The company's standardized tests found coding-focused models were no safer than general-purpose models, while Python led at 63% and Java trailed at 30%, reinforcing the need to scan and review AI-generated code before deployment.
Veracode released its 2026 GenAI Code Security Report on July 28, finding that progress in code generation has not produced a comparable improvement in secure output. Across four testing snapshots and more than 100 models tracked since the program began, the company reported an average security pass rate of 56%, virtually unchanged from the previous year's result. The same tests put syntax success near 100%.
What the benchmark measured
Veracode evaluated raw models on standardized code-generation tasks covering multiple programming languages and vulnerability categories. The prompts did not include security-specific guidance. Under those conditions, generated code failed a security test in about 44% of cases.
That figure should not be read as a universal defect rate for every production codebase. It describes performance on Veracode's selected tasks and test conditions. The comparison also excluded the additional controls that production teams may apply through coding agents, static analysis, policy checks, guardrails, and human review.
Specialized coding models did not lead
The report challenges two common assumptions. Coding-focused models averaged a 51% security pass rate, compared with 52% for general-purpose models. Model size also showed little advantage: large models averaged 53%, while medium and small models averaged 51%. Reasoning models performed somewhat better, averaging 56% versus 51% for non-reasoning models.
Results varied more by model and language. Veracode reported GPT-5.5 at 68% on its Summer 2026 leaderboard, while six of the 11 listed models clustered between 50% and 53%. Python had the strongest language average at 63%; Java remained last at 30%, despite showing an improving trend.
The operational implication
For engineering teams, syntactic correctness is a weak security signal. Code can compile, satisfy a functional prompt, and still choose an unsafe implementation. The report supports treating AI output like other unreviewed contributions: require security checks before merge, scan dependencies and generated code, and keep accountable review in the deployment path.
The practical question is not whether a model can produce working code quickly. It is whether the surrounding workflow can detect the security failures that functional tests do not measure.
Key Points
- 1Veracode reports a 56% average security pass rate across four snapshots and more than 100 tested models, despite near-universal syntax success.
- 2Coding-focused models averaged 51%, compared with 52% for general-purpose models; larger models also showed no meaningful security advantage.
- 3Python led the language results at 63% while Java trailed at 30%, so teams should treat model output as unreviewed code and enforce security gates.
Scoring Rationale
The report provides a current, repeatable benchmark across more than 100 models and directly informs secure AI-assisted development. Its practical significance is high, while the findings remain vendor-produced and benchmark-specific rather than a measurement of every production environment.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
