AI coding assistants now write a large and growing share of production code, and the evidence says that code carries security flaws and leaked credentials at rates no reviewer should assume away. This page collects the most cited figures on AI generated code security, each traced to the publisher's own report, paper or survey page, with the year it describes. It covers four themes: how much code AI writes and how widely the tools are used, how often generated code is vulnerable, how AI assisted development changes secret leakage, and what happens in the software supply chain when models invent package names. It is for security leaders building a business case and for AppSec teams setting review policy. The practice side, how to review and gate this code, is in the AI-Generated Code Review Guide; this page is the numbers. Last reviewed: November 2026.
Key takeaways
- Adoption is close to universal. 84% of respondents to the Stack Overflow Developer Survey 2025 use or plan to use AI tools, and the 2025 DORA research found 90% of technology professionals use AI at work.
- Roughly four in ten to one in two generated samples fail security tests. Academic testing of early Copilot found about 40% of 1,689 programs vulnerable (IEEE S&P 2022); Veracode's 2025 GenAI Code Security Report found flaws in 45% of tests across more than 100 models.
- Newer models are not automatically safer. Veracode reported that larger, newer models did not show better security results, so model upgrades do not replace review.
- AI assisted commits leak more secrets. GitGuardian measured a 6.4% secret leakage rate in public repositories using Copilot against 4.61% overall (2024 data), and about twice the baseline for Claude Code co-authored commits in 2025.
- Developers trust the output less than they use it. 46% of Stack Overflow 2025 respondents distrust the accuracy of AI output, against about 33% who trust it, yet daily use is near half of all respondents.
How to read these numbers
AI code security figures come from three kinds of source, and they are not interchangeable. Controlled studies (academic papers and vendor benchmark reports) give a model a prompt with a known weakness opportunity and test the output; they measure what a model produces when nobody intervenes. Telemetry studies (secret scanning across public GitHub, platform reports) measure what actually reaches repositories. Surveys measure what developers say they do and believe. A 45% failure rate in a benchmark does not mean 45% of your merged code is vulnerable, because review, SAST and tests sit in between; it does mean the raw material arriving at review is weak in a predictable way.
| Source type | Examples on this page | What it measures | Main limitation |
|---|---|---|---|
| Controlled academic study | Pearce et al. (IEEE S&P 2022), Perry et al. (ACM, 2023), Spracklen et al. (USENIX Security 2025) | Vulnerability or hallucination rate per generated sample | Specific models and dates; prompts chosen to expose weaknesses |
| Vendor benchmark report | Veracode 2025 GenAI Code Security Report | Security test failure rate across many models and languages | Methodology set by a vendor that sells testing |
| Telemetry | GitGuardian State of Secrets Sprawl 2025 and 2026, GitHub Octoverse 2025 | What reaches public repositories | Public code only; attribution of AI use is partial |
| Survey | Stack Overflow Developer Survey 2025, DORA 2025 | Adoption, trust, self-reported productivity | Self-reported; respondent population skews engaged developers |
Adoption: how much code AI writes
| Figure | Value | Source and year |
|---|---|---|
| Developers using or planning to use AI tools | 84% (up from 76% the previous year) | Stack Overflow Developer Survey 2025, 33,662 respondents to the question |
| Developers using AI tools daily | 47.1% of all respondents; 50.6% of professional developers | Stack Overflow Developer Survey 2025 |
| Developers using AI agents at work | About 31% (14.1% daily); 37.9% have no plans to adopt agents | Stack Overflow Developer Survey 2025, 31,877 respondents |
| Technology professionals using AI at work | 90% | Google Cloud DORA, State of AI-assisted Software Development 2025, nearly 5,000 respondents |
| New GitHub developers using Copilot in their first week | Nearly 80% | GitHub Octoverse 2025 (September 2024 to August 2025) |
| Open source projects with at least one maintainer using Copilot | 50% | GitHub Octoverse 2025 |
| Pull requests created by Copilot coding agent | More than 1 million, May to September 2025 | GitHub Octoverse 2025 |
| Share of new code at Google generated by AI | More than a quarter, then reviewed and accepted by engineers | Alphabet Q3 2024 earnings remarks, Google blog, 29 October 2024 |
The Google figure is a single company's statement about its own engineering, not an industry measure; it is widely repeated and is useful only as an indicator of direction. Public repositories importing an LLM SDK passed 1.1 million in Octoverse 2025, with 693,867 created in the previous 12 months, which means AI is now both writing code and being built into it. For the agent side of this, see the AI Coding Agents Security Guide.
Vulnerability rates in generated code
| Study | Scope | Finding | Year |
|---|---|---|---|
| Pearce et al., "Asleep at the Keyboard?" (IEEE Symposium on Security and Privacy) | 89 scenarios built around high-risk CWEs; 1,689 programs from GitHub Copilot | Approximately 40% vulnerable | Preprint 2021; published 2022 |
| Perry et al., "Do Users Write More Insecure Code with AI Assistants?" (ACM) | User study with an assistant based on codex-davinci-002 | Participants with the assistant wrote significantly less secure code and were more likely to believe it was secure | 2023 |
| Veracode, 2025 GenAI Code Security Report | More than 100 LLMs; Java, JavaScript, Python and C# | Risky security flaws introduced in 45% of tests | July 2025, updated October 2025 |
| Veracode, by language | Same study | Java 72% security failure rate (highest); C# 45%; JavaScript 43%; Python 38% | 2025 |
| Veracode, by weakness | Cross-site scripting (CWE-80) tasks | Models failed to defend against XSS in 86% of relevant samples | 2025 |
Two points stand out. First, the rate has not fallen much in three years of model progress: about 40% for 2021 Copilot and 45% across 2025 models are in the same range, and Veracode states that larger and newer models did not perform better on security. Second, the Perry et al. result is the more worrying one for policy: assistance raised confidence while lowering security, which is exactly the condition under which review gets skipped. Weakness classes where the safe pattern depends on context the model cannot see, such as output encoding for XSS, fare worst. Treat these as rates for unreviewed output; see the AI-Assisted Code Review and AI SAST Guide for what catches them.
Secrets and credential leakage
| Figure | Value | Source and data year |
|---|---|---|
| Secret leakage rate, public repositories with Copilot active | 6.4%, about 40% above the all-repository rate of 4.61% | GitGuardian State of Secrets Sprawl 2025 (2024 data, 69.6 million repositories) |
| New secrets in public GitHub commits | 23,770,171 in 2024 (up 25%); 28,649,024 in 2025 | GitGuardian State of Secrets Sprawl 2025 and 2026 |
| Claude Code co-authored commits | Leak secrets at about twice the baseline rate for all public commits | GitGuardian State of Secrets Sprawl 2026 (2025 data) |
| AI service secrets exposed | 1,275,105, with 81% year-on-year growth in AI-related service secrets | GitGuardian State of Secrets Sprawl 2026 |
| Unique secrets in MCP configuration files | 24,008; Google API keys 19.2% and PostgreSQL connection strings 14% of them | GitGuardian State of Secrets Sprawl 2026 |
| Valid secrets from 2022 still active | 64% four years later | GitGuardian State of Secrets Sprawl 2026 |
The pattern is consistent across both editions: when AI tools speed up commits, credentials leak faster, and the credentials being leaked increasingly belong to AI services themselves (model provider keys, search and scraping APIs, agent tool configurations). MCP configuration files are a new home for hardcoded secrets because agents need credentials to call tools and the easiest place to put them is a JSON file in the repository. The Amazon Q MCP Config Vulnerability 2026 shows how a configuration file in a repository becomes a route to a developer's cloud credentials. Broader secrets figures are in the Non-Human Identity and Secrets Statistics Guide; triage practice is in the Developer Secret Scanning Triage.
Package hallucination and supply chain
| Figure | Value | Source and year |
|---|---|---|
| Code samples analysed | 576,000 across two languages | Spracklen et al., "We Have a Package for You!", USENIX Security 2025 (preprint June 2024) |
| Hallucinated package rate, commercial models | At least 5.2% on average | Spracklen et al., 2025 |
| Hallucinated package rate, open source models | 21.7% on average | Spracklen et al., 2025 |
| Unique hallucinated package names | 205,474 | Spracklen et al., 2025 |
Every invented package name is a name an attacker can register. The study's volume, more than 200,000 unique names, shows why blocking at the registry or proxy, rather than trusting developers to notice, is the realistic control. See the Slopsquatting and Package Hallucination Guide. On the remediation side, GitHub Octoverse 2025 reports Broken Access Control as the most common CodeQL alert, flagged in more than 151,000 repositories (up 172%), and an average fix time for vulnerabilities falling from 37 to 26 days; automated fixing is now part of the same AI loop as automated writing.
Trust and developer behaviour
| Figure | Value | Source and year |
|---|---|---|
| Distrust accuracy of AI output | About 46% (26.1% somewhat, 19.6% highly) | Stack Overflow Developer Survey 2025, 33,244 respondents |
| Trust accuracy of AI output | About 33% (29.6% somewhat, 3.1% highly) | Stack Overflow Developer Survey 2025 |
| Top frustration | 66% cite AI solutions that are almost right, but not quite | Stack Overflow Developer Survey 2025, 31,476 respondents |
| Favourable sentiment toward AI tools | About 60%, down from over 70% in 2023 and 2024 | Stack Overflow Developer Survey 2025 |
| Little or no trust in AI generated code | 30% | Google Cloud DORA 2025 |
| Believe AI has increased their productivity | More than 80% (self-reported) | Google Cloud DORA 2025 |
Stack Overflow's trust and sentiment percentages are sums of the survey's chart segments, so they may differ slightly from the underlying data. "Almost right" code is the security problem in miniature: it compiles, passes the happy path test and fails on the input nobody tried.
What the numbers mean for defenders
- Assume the review queue has grown and the input has weakened: near-universal adoption plus a 40 to 45% flaw rate in unreviewed output means more code arriving per reviewer with more defects in it. Budget reviewer time and automated checks accordingly; do not rely on model upgrades.
- Gate on the classes AI gets wrong: context-dependent weaknesses (XSS, access control, injection) need SAST rules and tests in the pipeline, enforced as required checks. This maps to NIST CSF 2.0 PR.PS-06 and NIST SP 800-53 SA-11 (Developer Testing and Evaluation).
- Put secret scanning at the editor and pre-commit stage: leakage doubles with AI assisted commits, and 64% of old valid secrets stay live. Push protection plus revocation, not just detection, is what reduces exposure (SP 800-53 IA-5).
- Treat AI service keys and MCP configs as first-class secrets: include model provider keys and agent tool credentials in your secrets inventory and rotation policy; see the Git Secret Scanning Guide.
- Block unknown packages by default: with hallucination rates of 5 to 22%, route installs through a proxy or allow list and alert on first-seen package names (SP 800-53 CM-8 for component inventory).
- Measure overconfidence: the Perry et al. finding argues for policy that requires the same review for AI assisted changes, and for labelling such changes so you can measure their defect rate separately.
| Metric to track internally | Why it matters | Benchmark from this page |
|---|---|---|
| SAST findings per 1,000 lines, AI assisted versus other changes | Tests whether external flaw rates apply to you | 40 to 45% of unreviewed samples flawed (Pearce 2022; Veracode 2025) |
| Secrets blocked at pre-commit per month | Shows push protection is working | 6.4% leak rate with Copilot versus 4.61% overall (GitGuardian 2025) |
| Median time to revoke a detected secret | Leaked secrets stay valid for years | 64% of 2022 valid secrets still active (GitGuardian 2026) |
| First-seen package installs blocked | Slopsquatting exposure | 5.2 to 21.7% hallucination rate (Spracklen 2025) |
| Mean time to fix code vulnerabilities | Remediation keeps pace with volume | 37 to 26 days average on GitHub (Octoverse 2025) |
For a board-level summary see the Application Security and AI-Generated Code Executive Briefing, and for wider context the Application Security Statistics Guide.
Practitioner checklist
- Quote each figure with its publisher, report name and year, and say whether it is a benchmark, telemetry or survey result.
- Label AI assisted commits or pull requests so you can measure your own flaw and leak rates against these benchmarks.
- Make SAST, dependency checks and secret scanning required status checks for all changes, with no exemption for AI generated code.
- Enable push protection for secrets at pre-commit and in the hosting platform, and pair every detection with revocation.
- Add AI provider keys and MCP configuration files to secrets inventory, scanning and rotation scope.
- Route package installs through a registry proxy or allow list and alert on first-seen names.
- Write secure coding instructions into assistant configuration and review them as code.
- Refresh this evidence each year when the Stack Overflow survey, DORA, Octoverse and GitGuardian reports update.
Standards and references
- Veracode: 2025 GenAI Code Security Report findings
- Pearce et al.: Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
- Perry et al.: Do Users Write More Insecure Code with AI Assistants?
- Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
- GitGuardian: State of Secrets Sprawl 2026
- GitGuardian: State of Secrets Sprawl 2025
- GitHub: Octoverse 2025
- Stack Overflow: 2025 Developer Survey, AI
- Google Cloud: Announcing the 2025 DORA report
Related NHI Mgmt Group resources: AI-Generated Code Review Guide · Vibe Coding Security Guide · Slopsquatting and Package Hallucination Guide · Non-Human Identity and Secrets Statistics Guide · AI Code Security and Agentic Coding Security Buyer's Guide