AI writes code that compiles but is not safe
· re: 2026 GenAI Code Security Report: AI-Generated Code Security Has Stalled at 56% Pass Rate (Veracode)
Here is the number to sit with from Veracode’s 2026 code-security report: AI models now write code that compiles almost 100% of the time, but only about 56% of it passes a security scan without introducing one of the OWASP Top 10 vulnerabilities. The other 44% carried a flaw.
And it is not improving. Across four snapshots and more than 100 models tracked since last year, that 56% pass rate has barely moved, even as the models got obviously smarter at everything else.
My read: “it compiles and the tests pass” was never what “safe to deploy” meant, and AI coding has turned that gap from a philosophical point into a production one. The model is optimised to produce code that looks right and runs, because that is what we reward it for. Nobody rewarded it for not writing an SQL injection.
The uncomfortable part is that the better the code looks, the less anyone reads it. A confident, well-structured function that quietly drops user input into a query is more dangerous than obviously bad code, because it sails straight through the human glance that was your last line of defence.
I am not anti-AI-coding, I use it every day. But I treat its output like a pull request from a brilliant intern who was never told about security: read it, run a scanner over it, assume the boring vulnerabilities are in there until proven otherwise. Speed is not the same as trust.