AI-generated code is becoming more secure, but vulnerabilities remain common, according to Veracode’s latest GenAI Code Security Report. The share of secure code rose from 56% to 62%, while the proportion containing vulnerabilities fell from 44% to 38% — the largest improvement since the report series began in July 2025. Anthropic’s Claude Opus 5.5 and OpenAI’s GPT-6-Sol jointly achieved the highest score, at 73%, ahead of the previous high of 68% recorded by GPT-5.5 in July 2026.
“We’ve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode. “This is the first time since running our study that we’ve been able to report a meaningful move on the security dial. Ten models now clear 60 percent, up from four in the last report, and the overall average has jumped six percentage points. With around half of code now generated by AI, today’s results are truly encouraging.”
AI code security varies by model and vulnerability type
Veracode assessed 18 models across Python, C#, JavaScript and Java, testing for four Common Weakness Enumeration (CWE) categories: SQL injection (CWE-89), cryptographic weaknesses (CWE-327), cross-site scripting (CWE-80) and log injection (CWE-117).
Claude Opus 5.5 and GPT-6-Sol tied at 73%, while models from Anthropic and OpenAI both featured among the top seven. In the July 2026 results, six of 11 models scored between 50% and 53%; in the latest analysis, only two remained in that range, while 10 surpassed 60%. However, the lowest scores remained between 44% and 50%, indicating that vulnerability rates still depend on the model selected.
Cross-site scripting was the main contributor to the overall improvement. Its score rose to 18%, making it the largest change in the dataset. By comparison, cryptographic weaknesses scored 87%, SQL injection 84% and log injection 13%, with the latter two categories showing no movement since the previous analysis.
Model size and code verification matter
Veracode attributes the different results partly to the nature of each vulnerability
Veracode attributes the different results partly to the nature of each vulnerability. XSS can be addressed through pattern recognition, while detecting log injection often requires data-flow reasoning across multiple functions — an area where the models continue to struggle.
The highest-scoring models also come with greater computing costs. Large models averaged 55% on security tasks, compared with 51% for small models, reversing the previous year’s finding that size had “essentially no effect” on security.
“The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60 percent pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73 percent with no verification. Organizations must look for a combination of coding model, security testing, and remediation to get the highest security outcome.”
Java remains a security outlier
General-purpose models averaged 54% on security tasks, compared with 51% for coding-specialised models. The difference has widened from one percentage point in July to three in the latest report. Overall, around four in 10 AI code tasks still resulted in vulnerable code, despite the fall in the vulnerability rate from 44% to 38%.
Java remained the weakest-performing language, scoring 31%, up only slightly from 30% in July. Python reached 64%, C# 60% and JavaScript 57%, leaving a gap of 26 to 33 percentage points between Java and the other languages.
Security debt remains a wider concern
Veracode said the improvement addresses only part of the wider software security challenge. Its 2026 State of Software Security report found that 82% of organisations have security debt — vulnerabilities left unresolved for more than a year. Third-party code accounts for 66% of the most dangerous long-lived vulnerabilities, which take an average of 358 days to fix.
“Newer LLMs are producing more code that’s both functional and secure, but that does not mean we can start blindly trusting AI-generated code,” Wysopal closed. “The most effective strategy isn't chasing the most expensive model for marginal gains; it's combining AI code generation with continuous, independent security verification that catches what the models miss. That approach covers the full risk surface, from first-party code to third-party dependencies."
Veracode, the pioneer in application risk management, announces a jump from 56 percent to 62 percent in overall AI-generated code security, alongside a drop in vulnerabilities from 44 percent to 38 percent — the most significant improvement since the GenAI Code Security Report series began in July 2025. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73 percent, surpassing the previous high of 68 percent set by GPT-5.5 in July 2026.
“We’ve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode. “This is the first time since running our study that we’ve been able to report a meaningful move on the security dial. Ten models now clear 60 percent, up from four in the last report, and the overall average has jumped six percentage points. With around half of code now generated by AI, today’s results are truly encouraging.”
Meaning vulnerability volume
Veracode tested 18 models across four languages (Python, C#, JavaScript, Java) and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117).
Claude Opus 5.5 and GPT-6-Sol tied at 73 percent, dethroning GPT-5.5, which led the summer 2026 snapshot at 68 percent. Anthropic and OpenAI each have models in the top seven. In July, six of 11 models sat between 50 and 53 percent; today only two remain in that band, while 10 clear 60 percent. The floor hasn't moved, however, with the bottom still at 44–50 percent, meaning vulnerability volume still depends on model selection.
Data-flow reasoning
Vulnerability type CWE-80, cross-site scripting (XSS), was the main driver of the overall gain. Despite being one of the weaker categories, XSS rose to 18 percent, in contrast to its modest uptick demonstrated in July’s analysis.
This represents the single biggest shift in the dataset. Meanwhile, crypto (CWE-327) held at 87 percent, Structured Query Language (SQL) injection (CWE-89) held at 84 percent, and log injection (CWE-117) remained flat at 13 percent. The reason is structural: XSS is the easiest vulnerability to fix through pattern recognition, which is exactly how LLMs improve. Log injection requires data-flow reasoning across multiple functions, where LLMs continue to stall.
Highest security outcome
The top-performing models carry premium compute costs. Performance also correlates with model size: large models average 55 percent versus 51 percent for small models, which reverses last year's finding that size had "essentially no effect" on security.
“The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60 percent pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73 percent with no verification. Organizations must look for a combination of coding model, security testing, and remediation to get the highest security outcome.”
Coding-specialized models
General models pull further ahead of coding models. General-purpose models average 54 percent on security tasks versus 51 percent for coding-specialized models — a gap that has widened from one to three points since July.
Nearly four in 10 AI code tasks still produce vulnerable code. The rate of vulnerabilities dropped from 44 to 38 percent. This is meaningful but still means roughly four in 10 tasks produced vulnerable code without security-specific guidance.
Java is still stuck. Java remains the dramatic outlier at 31 percent, barely up from 30 percent in July. The gap between Java and the other three languages (Python at 64 percent, C# at 60 percent, and JavaScript at 57 percent) is still 26–33 percentage points.
Long-lived vulnerabilities
The improvement is real but mends a small part of a larger wound. According to Veracode's 2026 State of Software Security report, 82 percent of organizations now carry security debt (vulnerabilities unresolved for more than a year). Moreover, 66 percent of the most dangerous, long-lived vulnerabilities come from third-party code, taking 358 days to fix on average.
“Newer LLMs are producing more code that’s both functional and secure, but that does not mean we can start blindly trusting AI-generated code,” Wysopal closed. “The most effective strategy isn't chasing the most expensive model for marginal gains; it's combining AI code generation with continuous, independent security verification that catches what the models miss. That approach covers the full risk surface, from first-party code to third-party dependencies."
