Notifications
Clear all
Topic starter
02/08/2026 11:37 am
TL;DR: Across more than 150 large language models, only 55% of AI-generated code passes basic security tests while syntax correctness exceeds 95%, according to Veracode, leaving security teams with fast-moving code that often looks right but still ships known flaws. The core problem is that speed now outpaces trust, and manual review cannot keep up with machine-scale code generation.
NHIMG editorial — based on content published by Veracode: AI Coding Tools Are Creating a Security Gap We Must Close Immediately
By the numbers:
- Those same AI models achieve syntax correctness rates above 95%.
- Only 42.2% of organisations have fully implemented secure coding and code review practices.
- Security debt now affects 82% of organisations, up from 74% a year ago.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding tools create a security risk even when code looks correct?
A: They optimise for syntax and pattern completion, not contextual security reasoning.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Treat AI-generated code as untrusted until verified Classify model output as provisional code and require automated security verification before merge.
- Standardise secure prompting across developer toolchains Create prompt templates that explicitly constrain insecure patterns, especially in authentication, authorisation, input handling, and logging paths.
- Gate production with automated security controls Use SAST, SCA, and build-time policy checks to block critical vulnerabilities before deployment.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- Model-by-model security pass-rate breakdowns across the tested large language models
- Detailed comparison of secure prompting, manual review, and automated scanning outcomes
- The full State of Software Security framing behind Prioritize, Protect, and Prove
- Specific recommendations for integrating build gates and continuous verification into delivery pipelines
👉 Read Veracode's analysis of AI-generated code security gaps and remediation priorities →
AI-generated code and the security trust gap: are controls keeping up?
Explore further
02/08/2026 12:50 pm
Software trust is becoming the real control plane for AI-assisted development. Traditional SDLC governance assumes developers can review output before risk is propagated, but AI coding tools compress the time available for review and remediation. That makes code assurance, not code generation, the strategic control point. The right question is no longer whether teams can write faster, but whether they can verify faster.
A question worth separating out:
Q: Should organisations prioritise secure coding controls before expanding AI developer tools?
A: Yes, if the current delivery process cannot verify code security at the same pace it can generate code. Organisations should strengthen scanning, secret detection, and release gating first, especially in identity-sensitive applications. Otherwise, AI tools simply amplify the volume of vulnerable code entering production.
👉 Read our full editorial: AI-generated code is widening the software security trust gap
