Veracode report: AI now writes half of committed code but only 56% pass security checks
WeldPond · x · 2026-10-22
Veracode's 2026 GenAI Code Security Report finds that among organizations using AI tools, AI writes roughly half of all committed code, yet across 100+ models tested since 2023 the average security pass rate is stuck at 56% — syntax near-perfect, security not.
Key points from the report and its Oct 22 webinar with Chris Wysopal and Jim Manico:
- Even the top-performing model fails nearly one in three security tasks, so "we use the best model" isn't a security strategy.
- The report tested models without security-specific prompting, motivating "intent-based coding": explicit, framework-specific security requirements given before code generation, not after.
- AI-SAST serves as a deterministic verification layer for AI-generated code and belongs in release gates.
- The "Security Token Furnace": the hidden cost of rework when AI code isn't secure on the first pass, and how to avoid it.
More from coding & agent
- MiniMax M3.1 Flash pairs with SGLang Omni for interruptible real-time voice agents — MiniMax_AI · 2026-10-22
- Routing strongest model every turn is bad design: one route per turn, pin through tools — WirelessLife · 2026-10-22
- v0 adds Slack MCP support: read threads and post updates from your agent — iamsahaj_xyz · 2026-10-22
- Insurer portals blocked their data-center bots, so they moved automation into the user's browser — alex_verem · 2026-10-22
- Chrome DevTools adds Ads panel showing per-script CPU and network cost of ads — gaganghotra_ · 2026-10-22
- Shipping v5.0.0 with one prompt: Rork Max agent walks the whole app release — rudrank · 2026-10-22