AI coding tools now write a large share of new code, and the code almost always compiles. Whether it is secure and maintainable is a different question, and in 2026 we finally have enough independent data to answer it. Veracode's 2026 test of the leading models puts the average security pass rate at 56%, unchanged from a year earlier. This article brings together the main measurements of AI-generated code quality and security, and turns them into controls you can put in place this quarter.
Why this matters now: adoption ran ahead of trust
Google's DORA 2025 report found that 90% of nearly 5,000 technology professionals use AI at work, and 65% rely on it heavily for software development. In the Stack Overflow Developer Survey 2025, 84% of developers use or plan to use AI tools, up from 76% a year earlier. Trust went the other way: 46% said they do not trust the accuracy of AI output, against about a third who do and only 3% who trust it highly. The top frustration, named by 66%, was AI solutions that are "almost right, but not quite"; 45% said debugging AI-generated code takes more time.
With coding agents now opening pull requests on their own, the volume of AI-written code is growing faster than review capacity. DORA's own conclusion is that AI acts as an amplifier: it magnifies the strengths of well-run engineering organisations and the weaknesses of struggling ones. The numbers below show where those weaknesses appear.
Security: the models got smarter, not safer
Veracode's GenAI Code Security Report gives models a fixed set of coding tasks in which a secure and an insecure solution are both possible, with no security hints in the prompt, and then scans the result. Its 2025 edition covered more than 100 models over 80 tasks and found that 45% of the samples introduced an OWASP Top 10 vulnerability. Java was by far the weakest language.
Source: Veracode 2025 GenAI Code Security Report (80 tasks, 100+ LLMs). In the 2026 report the pass rate was 63% for Python and about 30% for Java.
The 2026 report, published on 28 July 2026, tracks 11 current models. Syntax correctness is close to 100%, yet the average security pass rate is still 56%, "virtually unchanged" from 2025. Models handle well-known patterns such as SQL injection and the choice of cryptographic algorithms, and largely fail on cross-site scripting and log injection, where secure code depends on context the prompt does not state.
Source: Veracode 2026 GenAI Code Security Report as reported by eSecurity Planet (12 Aug 2026). Higher is better.
Model choice helps, but less than you might expect. OpenAI's GPT-5.5 leads the Summer 2026 leaderboard at 68%; GPT-5.3-Codex and Anthropic's Claude Opus 4.8 follow at 62% each, and six of the 11 models sit between 50% and 53%. Reasoning models average 56% against 51% for non-reasoning models, while coding-specialised models (51%) do no better than general-purpose ones (52%).
Sources: Veracode press release (28 Jul 2026) for GPT-5.5, Qwen3.7-max and the averages; eSecurity Planet for GPT-5.3-Codex and Claude Opus 4.8. Tested without security instructions in the prompt.
Bugs in review: what 470 pull requests show
CodeRabbit's "State of AI vs Human Code Generation" report (December 2025) compared 320 AI-coauthored and 150 human-only pull requests in open-source GitHub projects. AI pull requests averaged 10.83 issues against 6.45 for human ones, about 1.7× as many, with 1.4× more critical and 1.7× more major issues. The gap was widest for cross-site scripting.
Source: CodeRabbit, State of AI vs Human Code Generation (17 Dec 2025), 470 open-source PRs; category multipliers as reported by The Register. 1.0× would mean parity.
Two caveats apply. The sample is small and limited to open-source projects, and CodeRabbit sells AI code review. Still, the pattern matches Veracode's: the extra defects are logic errors and context-dependent security flaws, exactly the kind that look plausible in a diff.
Maintainability: codebases in "write-only mode"
GitClear analyses commit histories rather than test tasks. Its June 2026 report, "Write-Only Mode", covers 623 million changes from 2023 to 2026 and describes codebases that keep growing while older code is no longer touched. Refactoring moves fell 70% and updates to long-standing code fell 74%, while duplicated code blocks rose 81% and error-masking constructs (for example, catching and ignoring exceptions) rose 47%.
Source: GitClear, Write-Only Mode: AI Code Quality in 2026 (623M changes, 2023 = baseline, 2026 year to date). Amber = risk signals, dark = reuse signals.
The long-run view is the clearest. In 2022 developers moved (refactored) code about twice as often as they copy/pasted it. By 2024 copy/paste overtook moved code for the first time, and in the first half of 2026 copy/paste is about four times as common.
Sources: GitClear 2026 report (2022 and 2026 H1) and GitClear 2025 AI Copilot Code Quality report (2024, 211M lines). The two reports use different datasets; read the trend, not exact deltas.
GitClear measures the period in which AI assistants spread, not the author of each line, and it also sells engineering analytics. But duplication and dropped refactoring are exactly what you get when generating new code is cheaper than finding and reusing the existing function.
Supply chain: hallucinated packages and "slopsquatting"
A study presented at USENIX Security 2025 (University of Texas at San Antonio, University of Oklahoma, Virginia Tech) generated 576,000 Python and JavaScript samples with 16 models. 19.7% of the recommended packages did not exist, giving 205,474 unique invented names. When 500 prompts were re-run ten times, 43% of the hallucinated names came back every time, which makes them predictable. An attacker can register such a name and wait for an agent to install it; this is called slopsquatting.
Source: Spracklen et al., USENIX Security 2025; 576,000 samples, 16 models. CodeLlama hallucinated in more than a third of outputs. Models of 2024–2025; current frontier models were not tested.
The researchers found no confirmed attacks in the wild, but the risk grows as agents run install commands themselves. The fix is simple and cheap: an approved-package list or internal registry proxy, lockfiles, and a rule that agents may not add new dependencies without review.
What works: eight controls for AI-written code
| Risk | Control | Where it lives |
|---|---|---|
| Insecure defaults (XSS, log injection) | Secure-coding rules in the agent's context (CLAUDE.md, AGENTS.md, system prompt) with your framework's escaping and logging helpers | Repository |
| Vulnerabilities that slip through | SAST and secret scanning on every pull request, blocking on high severity; an AI security review pass (for example Claude Code's /security-review) as an extra layer | CI |
| Hallucinated or malicious packages | Registry proxy or allowlist, lockfiles, software composition analysis, no new dependency without approval | CI + package manager |
| Plausible but wrong logic | Tests written or reviewed by a human before the agent's change is merged; coverage gates on changed lines | CI |
| Duplication and drift | Duplication and complexity checks in CI; ask the agent to search for existing helpers before writing new ones | CI + prompts |
| Swallowed errors | Lint rules against empty catch blocks and broad exception handlers | Linter |
| Review overload | Small pull requests, an AI first-pass review, a human owner for every merge | Process |
| Agents with too much power | Least-privilege tokens, sandboxed execution, no direct push to main | Platform |
Two of these deserve emphasis. First, put security instructions into the context: Veracode's figures describe prompts without them, and rules files are the cheapest lever you have. Second, measure: track the share of merged lines that came from AI, findings per pull request and change failure rate, so you can see whether AI is amplifying your strengths or your weaknesses.
Regulation: the Cyber Resilience Act makes this a product duty
For companies that sell software or connected products in the EU, insecure AI-generated code is now also a compliance issue. Under the Cyber Resilience Act, the obligation to report actively exploited vulnerabilities applies from 11 September 2026, and the full secure-by-design requirements from 11 December 2027. The regulation does not care whether a person or a model wrote the vulnerable line. For Croatian and DACH manufacturers and software vendors, documented controls on AI-assisted development belong in the CRA preparation now.
The bottom line
AI coding tools deliver real speed, and the data does not argue for avoiding them. It argues against trusting their output by default. Models write code that compiles but fails a security test almost half the time, defects cluster in context-dependent flaws, and codebases accumulate duplication when nobody asks for reuse. Teams that add rules in the agent's context, scanning in CI, dependency controls and human ownership of every merge keep the speed without the debt.
Want AI coding speed without the security debt?
AI Workshop sets up AI-assisted development with guardrails that hold: secure-by-default prompts and rules, security scanning in CI, dependency controls and review policies for agent-written code. We work as Claude Certified Architects with teams in Croatia and the DACH region.
Talk to an AI consultant