--- title: Veracode: AI-generated code security pass rate stuck at... description: Veracode's 2026 GenAI Code Security Report tracked over 100 AI models for a year and found the average security pass rate for AI-generated code is just 56% —... canonical: https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Veracode: AI-generated code security pass rate stuck at 56% after a year of tracking | daily.dev og:description: Veracode's 2026 GenAI Code Security Report tracked over 100 AI models for a year and found the average security pass rate for AI-generated code is just 56% —... og:url: https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1 og:image: https://api.daily.dev/og/posts/fjN6nwsJ1.png og:image:alt: Veracode: AI-generated code security pass rate stuck at 56% after a year of tracking og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Veracode: AI-generated code security pass rate stuck at 56% after a year of tracking **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Veracode's 2026 GenAI Code Security Report tracked over 100 AI models for a year and found the average security pass rate for AI-generated code is just 56% — essentially unchanged from 55% a year ago. Model size, specialization, and reasoning capabilities make little difference. GPT-5.5 leads at 68%, but last year's top score was 72%. Java-generated code passes only 30% of security tests, while XSS has a 15% pass rate and log injection just 12%. The failures are predominantly OWASP Top 10 vulnerabilities. With AI now writing roughly half of all committed code, the flat failure rate means the total volume of insecure code is growing. Veracode recommends integrating security scanning directly into AI-assisted development workflows rather than relying on models to self-correct. ## Content Veracode's 2026 GenAI Code Security Report tested over 100 AI models across a full year and found almost no improvement in security outcomes. The average pass rate sits at 56% — up from 55% last year, which is essentially flat. That number matters more now than it did before. AI-generated code accounts for roughly half of all committed code today. The volume has exploded; the failure rate hasn't moved. ## What the numbers actually show When developers use AI coding tools without security-specific prompting, about 44% of the output fails security tests. These aren't obscure edge cases — the failures include OWASP Top 10 vulnerabilities. XSS had a catastrophic failure rate of 15%, log injection 12%. A few findings that cut against common assumptions: - Coding-specialized models (51% pass rate) are no safer than general-purpose ones (52%) - Larger models (53%) don't meaningfully outperform smaller ones - Reasoning models do slightly better at 56% vs. 51% for non-reasoning models, but it's a modest edge GPT-5.5 leads the leaderboard at 68%, though that's down from last year's top score of 72%. Language choice makes a bigger difference than model choice. Python passes 63% of security tests. Java passes only 30%. ## The core problem AI-generated code compiles fine. Syntax isn't the issue. The issue is that these models produce plausible-looking code that carries real vulnerabilities — and the volume of that code now far exceeds what any manual review process can realistically catch. More scanning alone won't fix this. Veracode's recommendation is to integrate security scanning directly into AI-assisted development workflows and treat AI-generated code the same way you'd treat any unreviewed code: with skepticism until proven otherwise. Faster code generation increases the rate at which insecure assumptions reach production. A 56% pass rate that isn't improving is a problem that compounds as adoption grows. ## Similar posts on daily.dev - [AI can find zero-days but still can’t reliably write secure code](https://daily.dev/posts/ai-can-find-zero-days-but-still-can-t-reliably-write-secure-code-gkwz7v79e) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding) [View this post on daily.dev](https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Veracode: AI-generated code security pass rate stuck at 56% after a year of tracking","url":"https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1"},"datePublished":"2026-07-29T00:34:06.521Z","dateModified":"2026-08-01T03:54:46.954Z","description":"Veracode's 2026 GenAI Code Security Report tracked over 100 AI models for a year and found the average security pass rate for AI-generated code is just 56% —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8727050a5f335ca5dbcab7d8e8dbf03a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8727050a5f335ca5dbcab7d8e8dbf03a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/veracode-ai-generated-code-security-pass-rate-stuck-at-56-after-a-year-of-tracking-fjn6nwsj1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Veracode: AI-generated code security pass rate stuck at 56% after a year of tracking"}]} ```