Security flaw rate
The share of AI-generated code samples containing a security vulnerability; Veracode measured 45% across 100+ models with no improvement in newer ones.
Models reproduce insecure patterns from training data — missing input validation, weak crypto, absent authorisation checks. Veracode's 2025 report tested 100+ LLMs in Java, JavaScript, Python and C# and found 45% of samples introduced a flaw; larger and newer models were no better. GitHub's Octoverse links a 172% rise in Broken Access Control alerts partly to AI-generated scaffolds skipping auth checks. Practical rule: treat every AI-generated module as unreviewed for security.