Notifications
Clear all
Topic starter
02/08/2026 11:52 am
TL;DR: AI coding assistants still produce secure code only 55% of the time, even as syntax correctness exceeds 95%, and security performance has stayed flat across more than 150 evaluated LLMs, according to Veracode’s Spring 2026 testing. The gap shows that productivity gains are not translating into safer software, so security review remains a required control rather than a downstream cleanup step.
NHIMG editorial — based on content published by Veracode: Spring 2026 GenAI Code Security Update
By the numbers:
- Veracode has evaluated over 150 large language models in this longitudinal study of AI code security.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding agents complicate secrets management?
A: AI coding agents complicate secrets management because they combine prompting, execution, and environment setup in one workflow.
Q: What do teams get wrong about syntax correctness in AI-generated code?
A: They confuse code that runs with code that is safe.
Practitioner guidance
- Block direct promotion of AI-generated code into production paths Require security review before AI-generated code can reach repositories that handle authentication, session management, token issuance, or secret storage.
- Run SAST on all AI-assisted pull requests Add static analysis to the merge gate so insecure constructs are detected even when the code compiles cleanly.
- Mandate secure prompting for identity-sensitive code Tell developers to ask models for parameterised queries, safe output encoding, minimal secret exposure, and explicit authorisation checks whenever code touches identity or data-handling logic.
What's in the full report
Veracode's full update covers the operational detail this post intentionally leaves for the source:
- The full benchmark methodology across 80 tasks, 4 languages, and 4 CWE types, including how secure and insecure outputs were scored
- The language-by-language and CWE-by-CWE breakdowns that show where AI-generated code fails most often in practice
- The model-by-model comparison across major releases, including the reasoning-model outliers and their security pass rates
- The analysis of how training data, workflow incentives, and dataflow limitations combine to keep security performance flat
👉 Read Veracode's Spring 2026 GenAI code security update →
AI-generated code security is still lagging behind developer productivity?
Explore further
02/08/2026 1:01 pm
Productivity has outpaced security in GenAI code generation. The article shows that syntax quality can improve while security quality stays flat, which means the industry has learned to measure the wrong success criteria. Security teams should not treat AI-generated code as inherently better than human code, because the real issue is whether it preserves trust boundaries, not whether it compiles.
A question worth separating out:
Q: Should organisations require human review for AI-generated authentication code?
A: Yes, especially when the code touches login flows, session creation, token issuance, or authorisation logic. Those paths determine who can access what, so an error can create direct privilege exposure. Human review should verify intent, dataflow, and boundary checks, not just whether the code meets the functional requirement.
👉 Read our full editorial: GenAI code security is stuck while syntax quality keeps improving
