AI can now write compilable code almost every time it tries. It still ships a security hole in nearly half of it, and that has not changed in a year.

That is the headline finding of Veracode’s 2026 GenAI Code Security Report, which tested more than 100 models across four snapshots. The average security pass rate sits at 56%, almost exactly where it began at 55%.

Read that number against the other one in the report. AI now writes roughly half of all committed code. The failure rate held steady while the volume underneath it exploded.

Syntax is solved. Security is not.

The gap is stark. Given no security-specific prompting, models produce code that compiles about 100% of the time. On security, they fail nearly 44% of the time, introducing a vulnerability from the OWASP Top 10.

“Models may be almost syntactically perfect, but they are still failing on nearly half of all tasks where security is needed,” said Chris Wysopal, Veracode’s co-founder and chief security evangelist. “That number should be a red flag for any organization.”

One caveat matters here. The tests ran against raw models, with no agents, guardrails or human review in the loop. In a real pipeline those add a layer of defence. So 56% is the rate at which models generate flaws, not the rate at which they reach production.

Three assumptions the data kills

The report takes apart some comfortable beliefs.

Models built specifically for coding are not safer. They averaged 51%, marginally behind the 52% of general-purpose models. Choosing a coding-optimised tool to reduce risk buys nothing.

Size does not help either. Large models scored 53%, medium and small both 51%. Scaling up does not close the gap.

Only one factor moved the needle. Reasoning models averaged 56% against 51% for the rest. The extra reasoning steps appear to work like an internal code review before the answer lands.

The leaderboard, and its twist

OpenAI’s GPT-5.5 tops this round at 68%. Six of the 11 models tested cluster between 50% and 53%, with Alibaba’s Qwen3.7-max last at 50%, shipping a vulnerability every other output.

Even the leader is not reassuring. At 68%, GPT-5.5 still fails almost one security task in three. And it is a step backwards, because last year’s leader scored 72%. The top of the field went down.

The ranking has also globalised. Moonshot’s Kimi-K2.6 and Xiaomi’s MiMo-V2.5 now outscore several Western models. Provenance becomes one more thing procurement teams have to weigh.

Where the holes actually are

The averages hide sharp splits. By language, Python passed 63% of the time and Java just 30%. Java is by far the riskiest, though it is the only language on a clear upward path.

By vulnerability type the spread is wider still. Models handled SQL injection and weak cryptography reasonably well, at 83% and 87%. On cross-site scripting and log injection they collapsed, to 15% and 12%. Those are not edge cases, and the models barely register them.

The volume problem

None of this would matter much if AI wrote a sliver of the codebase. It no longer does.

The failure rate looked survivable when AI was an experiment. It now runs across half of everything teams ship, at a speed no security team can match by hand. This is the measured floor under the anecdotes, from vibe-coding platforms leaking live projects to the agent attacks stacking up across the industry. It is also, as one security founder argued, how AI quietly moved the whole attack surface. It also complicates the promise that AI pays for itself, given how much enterprise AI still has not left the lab.

Veracode has an obvious interest in the alarm, since it sells tools to scan and fix exactly this. The report arrived a week before the Black Hat conference. The underlying data, though, is a like-for-like benchmark run the same way over a year, and it is not flattering to anyone.

Wysopal, for his part, is not arguing to lock the models away.

“The right answer is not restricting access; it’s transparent, evidence-based safety,” he said, having earlier defended keeping powerful models like Claude Fable and Mythos in developers’ hands. “Scan it, fix it, and never ship it blind.”

His last line is the one to keep. Until models reason about security the way they reason about syntax, the guardrails in the workflow are the product, not the AI. That gap has held for a year, and this is the real cost of enterprise AI that the capability charts do not show.

Get the TNW newsletter

Get the most important tech news in your inbox each week.