August 17, 2026 — Veracode has published a comprehensive report, the "GenAI Code Security Report 2026," which casts doubt on the security of code generated by artificial intelligence. Despite modern models demonstrating nearly flawless results in syntax tests, their ability to write secure code remains critically low. The study reveals a troubling paradox: code that compiles and performs its intended task may still contain fundamental vulnerabilities that are invisible during standard functional testing.
The Gap Between Functionality and Security
The study tested over 100 code generation models across four different slices. Results showed that, on average, models achieved only a 56% success rate on security criteria—a figure that has barely changed compared to similar testing a year ago. Meanwhile, in syntax tests, models demonstrate results close to 100%. This means AI is capable of creating code that looks correct and functions, yet employs unsafe implementation patterns.
Testing was conducted on standardized code generation tasks in various programming languages. Importantly, the prompts given to the models did not include specific instructions to adhere to security measures. Under these conditions, which simulate real-world developer work without additional constraints, the generated code failed security checks in approximately 44% of cases. This confirms the thesis that the speed of generating working code does not replace the need for strict quality control.
Model Size and Specialization Do Not Solve the Problem
One of the key findings of the report is that increasing computational power or specializing a model for programming tasks does not guarantee improved security. Specialized models for writing code showed an average result of 51%, which is only 1% lower than universal models (52%). Model size also had almost no effect on the final score: large models averaged 53%, while medium and small models averaged 51%.
The only noticeable advantage belonged to models with a reasoning mode, which achieved a result of 56% compared to 51% for the rest. In the Veracode ranking, the GPT-5.5 model took the lead with a score of 68%, however, 6 out of the 11 models presented in the test showed results in the range of 50% to 53%. This indicates that even the most advanced solutions on the market do not provide reliable protection against vulnerabilities "out of the box."
Language Specifics and Risks for Java
Analysis of the results revealed a significant difference in code security depending on the programming language used. Python showed the best average result at 63%, which may be due to more mature libraries and security practices in this language's ecosystem. Meanwhile, Java came in last with a score of only 30%, although experts note that its figures show a trend of improvement compared to previous periods.
These data underscore that syntactic correctness alone is not a reliable sign of security. Generated code can compile successfully and perform the assigned task while simultaneously using unsafe implementation methods. This creates a hidden threat for corporate systems where developers may rely on code functionality while ignoring its internal architecture.
Recommendations for the Industry
Veracode strongly recommends treating AI-generated code as unverified and potentially dangerous. The company urges developers and companies to pass all generated code through strict security checks before merging it with the main codebase. This includes dependency analysis, static analysis of the generated code itself, and human review.
The main practical conclusion of the tests is that automating code writing should not lead to automating decisions regarding its security. The speed of generating working code does not replace the control capable of detecting vulnerabilities that functional checks fail to reveal. Integrating AI into development processes requires the implementation of additional layers of protection and a revision of software security approaches.
