Topic starter
02/08/2026 11:37 am
TL;DR: Across more than 150 large language models, only 55% of AI-generated code passes basic security tests while syntax correctness exceeds 95%, according to Veracode, leaving security teams with fast-moving code that often looks right but still ships known flaws. The core problem is that speed now outpaces trust, and manual review cannot keep up with machine-scale code generation.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “AI Coding Tools Are Creating a Security Gap We Must Close Immediately”.
By the numbers:
- Those same models achieve syntax correctness rates above 95%.
- For SQL injection, AI models achieve an 82% security pass rate.
- For cross-site scripting, the security pass rate is just 15%.
Key questions
Q: What breaks when AI-generated code is only checked after commit?
A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.
Q: Why does high syntax accuracy not mean AI-assisted code is safe to deploy?
A: Syntax accuracy only shows that code is structurally valid.
Q: What are the signs that AI-assisted coding is creating more security debt than it removes?
A: Warning signs include a rising volume of code changes with the same or similar flaws, security teams struggling to keep pace with review and remediation, and developers accepting suggestions without critical scrutiny.
Practitioner guidance
- Standardise secure prompting for developers Define approved prompt patterns that instruct AI coding tools to avoid insecure defaults, risky dependencies, and unsafe data handling.
- Block known-flaw patterns at build time Use automated SAST and dependency scanning in the pipeline so code with high-risk vulnerabilities cannot proceed to release.
- Prioritise exploitable debt in critical assets Rank remediation by exposure, exploitability, and business criticality instead of trying to fix every finding at once.
Bottom line: AI-generated code is not just accelerating delivery. It is also accelerating the introduction of familiar vulnerabilities into production workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:50 pm
AI-generated code has turned software trust into a control-plane problem: the issue is no longer whether code can be written quickly, but whether the organisation can prove it is safe before it ships. Security assurance built for human-paced development cannot absorb machine-scale output without stronger policy gates, automated evidence, and release-time enforcement. The practitioner conclusion is simple: trust must be earned at the point of creation, not assumed at merge time.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
A: Preventative guardrails should come first because runtime scanning only sees what already exists. AI-assisted development compresses the time between creation and exposure, so the most effective control point is before code is committed or deployed. Runtime testing still matters, but it cannot substitute for generation-time policy and architectural constraints.
👉 Read our full editorial: AI-generated code is widening the software security trust gap