AI code security hits 62% pass rate: Veracode 2026 study

AI now writes about half of all code, yet nearly four in ten AI-generated snippets still contain vulnerabilities. CISOs and development leaders need hard data on which models produce secure code and where the gaps remain. Softprom is the official distributor of Veracode.

Veracode's new GenAI Code Security Report for October 2026 delivers that evidence: the first measurable improvement in AI code security since the series began in July 2025, with the overall pass rate climbing from 56% to 62% and vulnerability rate dropping from 44% to 38%.

What was announced

On 29 October 2026, Veracode released the October 2026 edition of its GenAI Code Security Report. The study analysed 18 large language models across four programming languages (Python, C#, JavaScript, Java) and four CWE categories (CWE-89 SQL injection, CWE-327 cryptography, CWE-80 XSS, CWE-117 log injection).

Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol tied at a record 73% security pass rate, surpassing the previous high of 68% held by GPT-5.5. Ten models now exceed 60%, up from four in the previous report.

This is the first time since running our study that we have been able to report a meaningful move on the security dial. Ten models now clear 60 percent, up from four in the last report, and the overall average has jumped six percentage points

Why this matters

For CIOs, CISOs and procurement leaders, the data reframes AI coding assistant strategy. The gains are real but uneven: cross-site scripting (CWE-80) drove most of the improvement, while log injection (CWE-117) remained flat at 13% because it requires data-flow reasoning that LLMs still cannot handle.

Top-tier models also carry premium compute costs. Large models average 55% versus 51% for small ones, reversing last year's finding that size had no effect. According to Veracode's 2026 State of Software Security report, 82% of organisations now carry security debt, and 66% of the most dangerous long-lived vulnerabilities come from third-party code, taking 358 days to fix on average.

Technical details

• Overall pass rate: 62% (up from 56%)
• Vulnerability rate: 38% (down from 44%)
• Leaders: Claude Opus 5.5 and GPT-6-Sol tied at 73%
• Models tested: 18 LLMs across four languages
• Weakest language: Java at 31%, versus Python 64%, C# 60%, JavaScript 57%
• CWE results: Crypto 87%, SQL injection 84%, XSS 18%, log injection 13%
• General vs coding models: 54% vs 51% security pass rate

FAQ

How secure is AI-generated code in 2026?

The average security pass rate across 18 tested LLMs is 62%, meaning roughly 38% of AI-generated code still contains vulnerabilities without additional security verification.

Which LLM produces the most secure code?

Claude Opus 5.5 from Anthropic and GPT-6-Sol from OpenAI tie at 73% pass rate in Veracode's October 2026 benchmark, both surpassing the previous leader GPT-5.5 at 68%.

Is it enough to use the most expensive model?

No. Even leading models fail more than one in four security tasks. Veracode recommends combining a mid-tier model with continuous security scanning and remediation for a stronger, more cost-effective outcome.

Softprom and Veracode

Softprom is the official distributor of Veracode. Our team helps enterprises deploy Veracode Static Analysis, Dynamic Analysis, Software Composition Analysis, Veracode Fix and Application Security Posture Management to secure code from creation to cloud deployment.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.