Artificial intelligence has become remarkably effective at generating code that compiles successfully, but a new industry report warns that the technology continues to struggle with one critical area: software security. According to Veracode’s 2026 GenAI Code Security Report, nearly half of AI-generated code still fails basic security assessments, raising concerns as businesses increasingly rely on AI for software development.
The report evaluated more than 100 artificial intelligence models across four rounds of testing to measure their ability to produce secure code. While AI systems consistently generated syntactically correct and compilable code, the average security pass rate reached only 56 percent, showing only a slight improvement from 55 percent recorded in the previous year.
The findings suggest that although AI has become more capable of writing functional code, it has made limited progress in preventing security vulnerabilities that could expose applications to cyber threats. As organizations accelerate AI adoption, this gap has become a growing concern for developers, businesses, and cybersecurity professionals.
Veracode noted that AI-generated code now accounts for approximately half of all committed software code, making the issue increasingly significant. With AI contributing to a much larger share of software development, the unchanged security failure rate means more potentially vulnerable code could be entering production environments.
One of the report’s most surprising findings is that AI models specifically designed for programming did not outperform general-purpose AI models in terms of security. Coding-focused models achieved an average security pass rate of 51 percent, while general-purpose models recorded a slightly higher average of 52 percent.
Model size also appeared to have little impact on security performance. Large AI models achieved an average security score of 53 percent, while medium-sized and smaller models each averaged 51 percent. These results indicate that simply increasing a model’s size does not necessarily produce more secure software.
The report did identify one area where performance improved. AI systems equipped with advanced reasoning capabilities achieved an average security pass rate of 56 percent, compared to 51 percent for models without reasoning features. Researchers believe these reasoning mechanisms may function similarly to an internal code review process, allowing the AI to identify and correct potential weaknesses before generating the final output.
Cybersecurity experts emphasize that AI-generated code should never be deployed without human review and security testing. Developers are encouraged to combine AI-assisted coding with secure development practices, vulnerability scanning, code reviews, and penetration testing to minimize potential risks.
As AI becomes an essential tool in software engineering, organizations are increasingly balancing productivity gains with cybersecurity responsibilities. While AI can significantly speed up development and reduce repetitive coding tasks, the latest findings demonstrate that human expertise remains essential for identifying vulnerabilities and ensuring secure software deployment.
The Veracode report highlights an important reality for the technology industry: artificial intelligence is transforming software development, but it has not yet reached the point where security can be fully automated. Companies adopting AI coding tools should continue treating them as productivity assistants rather than replacements for experienced developers and cybersecurity professionals.
