Notifications
Clear all
Topic starter
02/08/2026 12:17 pm
TL;DR: OpenAI’s GPT-5 reasoning models reached a 72% secure-code pass rate in Veracode’s October 2025 benchmark, while most other providers stayed in the 50% to 59% range and persistent failures remained for XSS and log injection. Reasoning helps, but AI-generated code still needs human review, scanning, and runtime controls because insecure output remains common.
NHIMG editorial — based on content published by Veracode: GPT-5 Pulls Ahead on Secure Code While Rivals Stall
By the numbers:
- GPT-5-chat scored just 52%, well below OpenAI’s reasoning variants.
- Cross-Site Scripting (CWE-80) scored below 14% on average.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding assistants still produce insecure code?
A: They learn patterns from large code corpora that contain both secure and insecure examples, and they do not reliably reason about all dataflow or trust-boundary issues.
Q: What do security teams get wrong about secure-code benchmark scores?
A: They often assume a higher benchmark score means safe deployment.
Practitioner guidance
- Adopt reasoning-enabled coding models for sensitive work Use reasoning variants for code that touches authentication, secrets, input validation, or data handling.
- Require security validation before merge Run SAST, SCA, and review gates on all AI-generated code before it reaches main branches or release candidates.
- Treat generated code as untrusted input Apply the same scrutiny to AI-assisted code as to third-party contributions.
What's in the full report
Veracode’s full analysis covers the benchmark methodology and language-by-language results this post intentionally leaves for the source:
- The 80-task benchmark design across four programming languages and the release window used for comparison.
- Model-by-model score tables that show where GPT-5 reasoning variants outperformed non-reasoning counterparts.
- Vulnerability-class breakdowns for SQL injection, Cross-Site Scripting, log injection, and cryptographic handling.
- The update path from the July 2025 GenAI Code Security Report to the October 2025 dataset.
👉 Read Veracode’s analysis of GPT-5 secure code performance and model comparisons →
AI coding assistants and secure code quality: what changed?
Explore further
02/08/2026 1:18 pm
AI code security is becoming a control-plane problem, not a model-quality problem. Veracode’s results show that better reasoning changes output quality, but it does not remove the governance requirement to validate code before it reaches production. The real issue is that AI code assistants now sit inside software delivery pipelines that already depend on identity, access, and trust decisions. Practitioners should treat AI-generated code as a governed artifact, not a trusted author.
A question worth separating out:
Q: How can organisations tell whether an AI coding model is safe enough to use?
A: Use model-specific measures rather than generic vendor claims. Track pass rates by vulnerability class, compare reasoning and non-reasoning variants, and test the model on the languages and application patterns your teams actually ship. A model is only fit for use if it improves security outcomes in your environment without reducing review discipline.
👉 Read our full editorial: GPT-5 raises secure code scores, but AI coding risk remains
