On July 28, 2026, Veracode published its 2026 GenAI Code Security Report summary. It says roughly 44% of AI code generation tasks introduced a risky vulnerability in testing, and the average security pass rate is 56%, up from 55% in the first report. Models produce syntactically correct code nearly 100% of the time, so working code tells you nothing about safe code.
The post does not give counts of models, tasks or languages, so read the figures as Veracode's finding, not as a universal rate. The category breakdown is more useful than the headline.
What's affected
The pass rates Veracode reports by weakness:
| Weakness | Average pass rate |
|---|---|
| Cryptographic algorithms | 87% |
| SQL injection | 83% |
| Cross-site scripting | 15% |
| Log injection | 12% |
The top model scored 68%, and more than half of the tested models sat at 50 to 53%. In plain terms, models have learned to parameterize queries and pick sane algorithms. They have not learned to encode output or sanitize what goes into logs.
How to check if you're exposed
Find where AI-written code lands in your repository. Check pull request descriptions, commit trailers and your assistants' settings. Then look at the two weak categories directly:
# Output without encoding
grep -rnE "innerHTML|dangerouslySetInnerHTML|v-html|\|\s*safe\b|Markup\(|html_safe|raw\(" src
# User input written to logs
grep -rnE "(log|logger)\.(info|warn|error|debug)\(.*(req\.|request\.|params|input)" src
What to do now
Use this checklist on every pull request where a model wrote or edited code. It leans on the weak spots above.
- Output encoding. Every value reaching HTML, a template, a URL or a script context is encoded for that context. Check frameworks' escape hatches by name.
- Log hygiene. User-supplied values are sanitized or logged as structured fields, never concatenated into a message. No secrets or tokens in log lines.
- Authorization. Every new route checks who may do what to which object, not just whether the caller is logged in. Test with a second user.
- Input handling. Types, lengths and allowed values are validated at the boundary, and files and URLs go through the safe helpers described in your standards.
- Dependencies. Every new package exists, is the one you intended, is maintained, and is pinned. Check its registry page before you accept the import.
- Secrets. No keys, tokens or sample credentials in code or tests.
- Error paths. Failures do not return stack traces, and a failed check denies instead of allowing.
- Tests. The tests include a hostile input, not only the happy path. A test the model wrote to pass its own code proves little.
How this could have been avoided
- Put the checklist in the pull request template, so reviewers see it.
- Run SAST on the diff before a human reads it, so the first pass is mechanical.
- Gate the assistant in the editor, so findings appear while the code is written.
- Review the generated test as hard as the generated code.
Why it matters
Reviewing AI code is not a different skill. It is the same review with attention aimed where the failures cluster. Veracode's numbers say the problems are not random: encoding and log handling fail, while injection and crypto choices mostly pass.
Fast generation also changes the economics. The volume of code per reviewer goes up, so the checklist has to be short and the mechanical parts have to be automated.
Try it yourself
Take the last pull request that included assistant-written code and apply items 1 to 3 only. Time it. If it takes under ten minutes, make it the default for every such pull request.
Click through it at your own pace, or open it full screen.
Quick check
According to Veracode's 2026 summary, which two weakness categories had the lowest pass rates?
Log injection at 12% and cross-site scripting at 15%.
Why is passing tests written by the model weak evidence of safety?
The model writes tests that fit its own code, and they rarely include hostile input. Add tests that do.
