Topic starter
02/08/2026 11:52 am
TL;DR: AI coding assistants still produce secure code only 55% of the time, even as syntax correctness exceeds 95%, and security performance has stayed flat across more than 150 evaluated LLMs, according to Veracode’s Spring 2026 testing. The gap shows that productivity gains are not translating into safer software, so security review remains a required control rather than a downstream cleanup step.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Spring 2026 GenAI Code Security Update: Despite Claims, AI Models Are Still Failing Security”.
By the numbers:
- AI coding assistants now achieve syntax correctness rates exceeding 95%.
- Across all models and tasks, only 55% of generation tasks result in secure code.
- Veracode has evaluated over 150 large language models in its longitudinal study.
Key questions
Q: What fails when AI-generated code is functionally correct but not secure?
A: Functionally correct code can still introduce injection, logging, and cryptographic weaknesses that become exploitable after deployment.
Q: Why do secure code pass rates stay flat even as model capability improves?
A: Because models are trained and rewarded mainly for output quality, not for security outcomes.
Q: What do teams get wrong about securing AI coding assistants?
A: Teams often focus on code output and ignore the agent boundary, where file reads, tool outputs, and external content shape the next action.
Practitioner guidance
- Embed mandatory SAST in AI-assisted pipelines Run static analysis on every AI-generated change before merge, with gates for injection, logging, and cryptography weaknesses.
- Require secure prompting and threat-aware review Tell developers to ask models for secure-by-default patterns and to validate outputs against the application’s trust boundaries, especially where user input reaches rendering, logging, or database queries.
- Measure security pass rate separately from productivity Track the percentage of AI-generated snippets that pass security review, not just delivery speed or acceptance rates.
Bottom line: AI coding assistants are improving at producing syntactically valid code, but the study shows that secure code generation is still stuck near the same level it held two years ago.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:01 pm
Security pass rate is the real control metric, not syntax quality: code that compiles can still be a liability if it embeds known weaknesses. The article shows that the industry has over-indexed on productivity indicators while security outcomes remain flat. For practitioners, the lesson is to govern AI coding as a risk engine, not a productivity toy.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact. Require human approval, traceable authorship, scoped workload identities, and evidence of intent before production promotion. The goal is to preserve provenance and limit blast radius when generated logic behaves unexpectedly.
👉 Read our full editorial: GenAI code security is stuck while syntax quality keeps improving