Security flaw rate
The share of AI code-generation tasks that introduce a security vulnerability; Veracode measured 44% in 2026, essentially unchanged across four years and 100+ models.
Models reproduce insecure patterns from training data — missing input validation, weak crypto, absent authorisation checks. Veracode's 2026 report found 44% of code-generation tasks introduced a vulnerability (56% average pass rate, vs 55% four years earlier); coding-specialised models were no safer than general ones, and cross-site scripting (15% pass) and log injection (12%) were the weakest areas. GitHub's Octoverse links a 172% rise in Broken Access Control alerts partly to AI-generated scaffolds skipping auth checks. Practical rule: treat every AI-generated module as unreviewed for security.