Veracode Records First Meaningful Gain in AI-Generated Code Security Since 2025
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Veracode, in its fall report on the code that AI writes, sees the first notable improvement since the series began in July 2025: the average rate of secure code reaches 62%, up from 56%. Claude Opus 5.5 and GPT-6-Sol tie at the top with 73%, and ten of the 18 models tested clear 60%. Java, at 31%, remains far behind, and log injection does not move from 13%.
Veracode, an application security company, has published its fall report on how secure the code written by AI models is, and for the first time the improvement is notable in a series that began in July 2025. According to its press release of October 29, after testing 18 models across four languages (Python, C Sharp, JavaScript and Java), the average share of secure code rises from 56% to 62%. The report puts the share of tasks with vulnerabilities at around 44% before and close to 38% now.
Claude Opus 5.5, from Anthropic, and GPT-6-Sol, from OpenAI, tie for the lead at 73%, above the 68% GPT-5.5 reached in July 2026. Ten of the 18 models now pass 60%, against four in the previous report. By language, Python reaches 64%, C Sharp 60%, JavaScript 57%, and Java trails far behind at 31%.
According to Veracode, the gain comes mainly from XSS (cross-site scripting), a flaw that lets attackers inject malicious code into a website: the share of code that is secure against it, still low, rises to 18%. Encryption holds at 87%, SQL injection at 84%, and log injection stays at 13%. The company explains that XSS is the flaw best fixed by recognizing patterns, whereas log injection requires reasoning about how data travels across several functions, where models are still stuck.
Nearly four in ten tasks still produce vulnerable code when security is not specifically requested, and the top-scoring models still get more than a quarter of the security tasks wrong.
Chris Wysopal, co-founder and Chief Security Evangelist at Veracode, says the company has spent more than a year analyzing code from several models without seeing a clear improvement, that this is the first time it can report a meaningful advance, but that this does not mean AI-generated code can be trusted blindly.
Why it matters · analysis and opinion
That models write code that works is not enough: what counts for a company is how much of that code withstands an attack, and here the gain comes mainly from a single type of flaw, the easiest to spot by patterns. The ones that require following the path of data across several functions are unchanged, and the gap between the best and worst models persists, so choosing one or the other still matters. Anyone coding with AI assistants should not settle for an average figure: it is wise to ask for security explicitly in the instructions and to run an independent security scan before publishing, as Veracode itself advocates, though it also sells that kind of scanning.
Official source: Veracode · Written with the help of AI: how we make the news
