AI-Generated Code Security Shows First Major Improvement, But Risks Remain

Security Rates Improve

According to a new report by Veracode, AI-generated code security has seen its first significant improvement in a year. The overall security score for code produced by large language models rose from 56% to 62%, while estimated vulnerability rates dropped from 44% to 38%.

Leading models such as Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol reached the top of the leaderboard with a 73% security pass rate, surpassing previous benchmarks. Ten models now score above 60%, compared to just four in the previous evaluation.

Where AI Excels and Struggles

Researchers noted that the primary driver behind the security gains was better handling of cross-site scripting (XSS), which relies heavily on pattern recognition—an area where large language models excel. However, models continue to struggle with complex security reasoning and data-flow analysis across multiple functions, such as log injection vulnerabilities.

• Top Performers: Claude Opus 5.5 and GPT-6-Sol lead at 73%.
• Common Flaws Addressed: Better prevention seen in basic categories like XSS.
• Persistent Issues: Complex reasoning across multiple functions remains a weak point.

Practical Implications and Verification

Experts emphasize that despite the progress, top-tier models still fail on more than one in four security tasks. Furthermore, higher-performing models generally cost more to operate at scale, but simply using a costly model does not guarantee complete security.

Veracode advises organizations not to rely solely on frontier models. Instead, combining mid-tier models with independent, continuous security scanning remains a more cost-effective and scalable approach.

To review the original findings, readers can access the official GenAI Code Security Report published by Veracode.