Skip to content

AI picks the insecure option almost half the time, and newer models haven't fixed it

Veracode's GenAI Code Security research gives AI models coding tasks that can be completed securely or insecurely. In the 2025 report, covering 80 tasks and over 100 models, the insecure option was chosen in 45% of cases. The spring 2026 update, now covering more than 150 models, puts the security pass rate at about 55%, essentially unchanged, even though the code compiles correctly more than 95% of the time. Models handle some risks well, such as SQL injection, and others very badly, such as cross-site scripting, where they pass only 15% of the time.

By VibeGuard Team3 min read

There's a simple way to find out whether an AI model writes secure code. Give it a task that can be done two ways, one safe and one not, and see which it picks. Do that thousands of times across every major model and you have an answer that isn't anyone's opinion.

That's what Veracode, an application security company, has been doing since 2025. Their first report, published in July 2025, covered 80 coding tasks across Java, JavaScript, Python and C#, run against more than 100 AI models. The headline: the models chose the insecure option in 45% of cases.

The update they published in March 2026 is the more interesting one. It now covers over 150 models, including the newest ones, and the security pass rate is still about 55%. Veracode's summary is that it "remains stubbornly stuck."

The part that should change how you think about it

Over the same period, the models got much better at writing code that works. Veracode reports syntax correctness above 95%. So the code compiles, runs and does what you asked, while failing a security test almost half the time.

For a founder, that gap is the whole story. The only feedback most of us get from AI-written code is whether the feature works. It does, nearly always. That tells you nothing about the other question, and the tools are getting better at the first without getting better at the second.

Veracode puts it this way: models "have become excellent at writing code that compiles. They've failed at writing code that's safe."

Where it goes wrong, specifically

The failures aren't spread evenly, which is useful, because it tells you where to look.

RiskWhat it meansAI pass rate (2026)
SQL injectionSomeone types database commands into a form field82%
Weak cryptographyUsing outdated methods to protect data86%
Cross-site scripting (XSS)User-typed text runs as code in other people's browsers15%
Log injectionAttackers write fake entries into your logs13%

SQL injection is the famous one, and models have clearly learned to avoid it. Cross-site scripting gets far less attention, and models fail it most of the time. If your app shows anything a user typed to another user (a comment, a profile name, a message, a product review), that's the place to check.

By language, Python did best at 62% and Java worst at 29%. Apps built with Lovable, Bolt or Cursor are usually JavaScript or TypeScript, which landed at 57%.

Why it isn't improving

Veracode's explanation is fairly plain. Models learn from existing public code, and a lot of existing public code is insecure. Nobody asks for security in the prompt, so the model optimises for what was asked: working code. And some flaws, like whether one user can read another's data, depend on context the model doesn't have, because it doesn't know which data is private in your business.

That last point matters most for founders, and it's something these benchmark tasks don't really measure. The most damaging flaws we see in AI-built apps aren't textbook injection bugs. They're missing checks on who's allowed to see what, like the missing database rules behind the Moltbook leak. A model can't write a rule for a business requirement nobody told it about.

What to do with this

Don't stop using AI to build. Change what you trust it for.

Trust it for speed. Don't take "it works" as a sign that it's safe. The research says those are nearly independent.

Ask for specific protections. "Make sure user-provided text is escaped before it's rendered" works better than "make it secure." Veracode's own finding is that the 45% figure is what happens when no security guidance is given at all.

Check the predictable spots. Anywhere user text is displayed to others. Anywhere a record is fetched by an ID. Anywhere your app calls a paid service. Those three cover most of what goes wrong.

Then test the running app from the outside. The code can look fine and still behave badly once it's deployed with real settings. We collected the rest of the published numbers on our risks page, and the pre-launch checklist turns them into things you can check yourself this week.

Questions founders ask

Does this mean I shouldn't build with AI?

No. It means you should treat AI-written code the way you'd treat code from a fast, talented junior developer: useful, and in need of a security review before real users arrive. The problems are predictable, which makes them checkable.

Will telling the AI to 'make it secure' fix it?

It helps a little. Veracode's point is that without explicit security guidance, nearly half the output has known flaws. Specific instructions ('escape all user input before rendering it', 'check the user owns this record') work better than general ones, and testing the result still matters.

What is cross-site scripting in plain English?

It's when your app takes something a user typed, like a name or a comment, and puts it on a page without cleaning it. If that text contains code, it runs in other users' browsers, where it can steal their session or act as them.

Sources

  1. 2025 GenAI Code Security Report · Veracode, 30 Jul 2025
  2. Spring 2026 GenAI Code Security Update · Veracode, 24 Mar 2026

Is your app one of them?

An independent security check of your live app, from €59, with fix prompts for the coding tool you already use. Read-only, and it never touches your code.

Check my app

Keep reading

All articles