Notifications
Clear all
Topic starter
01/08/2026 8:56 pm
TL;DR: As AI now authors roughly half of committed code in adopted environments, Veracode reports that 44% of code-generation tasks still introduce vulnerabilities and the average security pass rate remains 56%, showing that secure output has not improved at the pace of adoption. The operational problem is no longer whether AI can write code, but whether verification, remediation, and governance can keep up.
NHIMG editorial — based on content published by Veracode: 2026 GenAI Code Security Report, AI is writing more of your code but security has not caught up
By the numbers:
- The average security pass rate across models is 56%, barely changed from 55% in the first report.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: When does AI-assisted development create more risk than it reduces?
A: It becomes net risk when code volume grows faster than ownership, review, and fix capacity.
Q: What do teams get wrong about securing AI coding assistants?
A: Teams often focus on code output and ignore the agent boundary, where file reads, tool outputs, and external content shape the next action.
Practitioner guidance
- Set security acceptance criteria for AI-generated code Define which code paths require mandatory human review, security scanning, or approval before merge.
- Evaluate models on security pass rate before broad rollout Compare model candidates using the same security task set and track the percentage of vulnerable outputs over time.
- Move verification into the development workflow Embed SAST, secure code review, and policy checks where code is written and merged, not only after release.
What's in the full report
Veracode's full report covers the operational detail this post intentionally leaves for the source:
- Model-by-model security pass rates and the relative spread between stronger and weaker code-generation systems
- Vulnerability-class breakdowns that show where AI output fails most often, including context-heavy weaknesses
- Research on how AI code volume is changing review queues, remediation pressure, and governance demand
- The report's broader findings on safe enablement, workflow verification, and platform decision-making
👉 Read Veracode's 2026 GenAI Code Security Report on AI-generated code risk →
AI-generated code security gaps: what AppSec teams need to do?
Explore further
01/08/2026 9:04 pm
GenAI code security is becoming a software trust problem, not a developer tooling problem. When AI authors a substantial share of committed code, the question shifts from speed to assurance. Security teams have to treat AI output as an untrusted software input that requires verification, policy, and traceability. That makes this a control-plane issue for AppSec, not a side conversation about developer efficiency. The practical conclusion is that secure delivery depends on security acceptance criteria for AI-written code, not just output volume.
A question worth separating out:
Q: How can organisations measure whether GenAI code security controls are working?
A: Track the proportion of AI-generated changes that fail security checks, the time to remediate vulnerabilities introduced by AI output, and the share of high-risk code paths covered by mandatory review. If those numbers are flat or worsening as AI usage grows, the governance model is not keeping pace.
👉 Read our full editorial: GenAI code security is a scale problem, not a syntax problem
