Since 2023, AI has become very good at writing code that runs. However, much like Man United’s defensive record, their security scores have barely moved.
Veracode’s 2025 GenAI Code Security Report ran 80 coding tasks across more than 100 models and found 45% of samples introduced OWASP Top 10 flaws. Its spring 2026 update tracked syntax pass rates climbing from roughly 50% to 95% since 2023, while security pass rates sat between 45% and 55%, regardless of model size.
Security failure rate by language
From the 2025 run. Across all four languages, cross-site scripting failed 86% of the time and log injection 88%.
Four studies speak to this.
The evidence
Veracode, 2025 and Spring 2026
- Setup
- 80 single-function tasks, 100+ models, 4 languages, output checked with a static scanner, no security hints in the prompt.
- Finding
- The numbers above are flat across 3 years of model releases.
- Caveat
- These are bare functions with no project context, and Veracode sells the scanner it used; a bit of I created the problem, but I magnanimously have a solution for you.
Tenzai, December 2025
- Setup
- 5 coding agents each built the same 3 apps from identical prompts.
- Finding
- 69 vulnerabilities across 15 apps, about 6 critical, and no exploitable SQL injection or XSS at all. Improper authorization showed up everywhere.
- Caveat
- 15 apps is a small sample, and Tenzai sells AI security testing, so they are double-dipping in a way.
Shukla, Joshi & Syed, 2025
- Setup
- Security-verified code pushed through repeated AI “improvements”, 400 samples, 4 prompting strategies.
- Finding
- Critical vulnerabilities rose 37.6% after 5 iterations. Security-focused prompts helped in 27% of iterations, mostly rounds 1 to 3.
- Caveat
- This groundbreaking conclusion is based on 10 seed samples in C and Java.
Mahmud et al., July 2026
- Setup
- 8,918 C++ programs from 3 open-weight models and human authors, checked 4 ways.
- Finding
- AI code roughly doubled the odds of a confirmed runtime violation. Under static analysis alone, the 2 groups looked equally safe.
- Caveat
- Copilot performs about as well as a human dev, provided you give it a short C++ homework problem and absolutely do not let it near your web application.
What they add up to
The textbook flaws are getting handled. Tenzai’s agents, working inside real frameworks, produced nothing exploitable in the 2 categories everyone worries about.
Context is where it breaks. Who may see which record, whether that URL is safe to fetch. Whether a refund can be a negative number. Those answers live in your app, and the model has never seen them, nor understands them.
Blind loops make it worse, and a scanner will lie to you. The iteration study and the C++ study point the same way. If you’ve ever typed “STILL BROKEN, PLEASE FIX!!” 5 times at 1 am, the first one is about you. It’s about all of us.
The audit protocol
- Scan the full git history for secrets. Deleting the file leaves the commit.
- Run a static scanner. A clean result is your starting point.
- Document the churn. Your most-rewritten files carry the most compounded AI edits.
- Hand-check the context flaws. Every endpoint returning a record: does it verify ownership? Every feature fetching a URL: is the destination restricted? Every flow touching money: what happens with a negative number?
- Attack your own staging. Log in as user A, request user B’s data by ID. Edit prices in DevTools before submitting. Point URL-fetch features at an internal address. Scanners can’t do this part, and it’s where the interesting findings are.
None of this says stop using AI to write code. It says the output could use a review and a second pair of experienced eyes.
That’s where we come in: book a free audit call, and you can finally give your bank account and tokens a breather.
