AI-generated code still frequently fails security checks, with Claude and GPT-6 topping the rankings
follow us
Add us as a preferred source on Google
- The security of AI-generated code improved for the first time in a year, with vulnerability rates dropping from 44% to 38%.
- The best models performed better at preventing common flaws like XSS, but still struggled with complex security reasoning
- The researchers emphasize that AI-generated code still requires independent testing and security verification before deployment.
Computer code generated by cutting-edge AI models has become more secure and consequently contains fewer vulnerabilities.
This is according to a new report from Veracode, which claims that this is the first significant improvement in a year.
In July 2025, Veracode began publishing its GenAI Code Security Report, which analyzed code generated by LLMs for vulnerabilities and security risks. Since then, the company’s researchers noticed a trend: the code worked almost perfectly, but on the security side it left a lot to be desired.
Latest videos ofTechnologyRadar
Are XSS flaws worth it?
“We’ve been analyzing code generated by multiple LLMs for over a year. So far, we haven’t seen a noticeable improvement in the security of AI code, despite consistently near-perfect functionality,” said Chris Wysopal, co-founder and chief security evangelist at Veracode.
“This is the first time since we conducted our study that we have been able to report significant movement in the security space.”
That significant move is a jump from 56% to 62% in the overall security of AI-generated code. At the same time, there has been a drop in vulnerabilities from 44% to 38%, Veracode added, saying this was the most significant improvement since reports began being published. Anthropic’s Claude Opus 5.5 and OpenAI’s GPT-6-Sol co-lead the rankings with 73%, surpassing the previous high of 68% set by GPT-5.5 in July 2026.
“Ten models now exceed 60%, up from four in the last report, and the overall average has increased by six percentage points,” Wysopal said. “With around half of the code now generated by AI, today’s results are really encouraging.”
To write the report, Veracode tested 18 models in four languages (Python, C#, JavaScript and Java) and four common weaknesses enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol took first place with 73%, followed by GPT-5.5, which holds 68%. In July, six of 11 models scored between 50 and 53, while today only two remain in that band, while 10 scored at least 60%. The minimum is still between 44% and 50% percent.
While the results are definitely commendable, there is a caveat. Apparently, the main driver of the overall gain was cross-site scripting (XSS), which is arguably one of the weakest categories. XSS increased to 18%, which is also the largest change in the data set. According to Veracode, XSS is the “easiest vulnerability to fix using pattern recognition,” which is exactly how LLMs improve. In cases where data flow reasoning across multiple functions is required (such as log injection cases), LLMs remain stagnant.
ripe fruit
In other words, the AI has just picked the low-hanging fruit and called it a day. We’re not sure if this should disappoint us, as XSS attacks are common and the vulnerability is still present throughout the web.
In the report, Veracode also said the water was wet and the sky was mostly blue: It found that high-performance models cost more.
However, they said throwing money at the problem probably isn’t the best solution: “The models that produce the most secure code are the ones that cost the most to run at scale, but still fail more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model with a 60% pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model with 73% no verification.”
In conclusion, the improvement is there, but “heals a small part of a larger wound,” Veracode said. Organizations should ensure they combine AI code with continuous, independent security verification that can detect what the models miss.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment