AI coding assistants such as GPT-5.1, Gemini 3, Claude 4.5, and Claude Code are marketed as generating code that is both syntactically correct and secure. Vendors claim that security-aware training has materially improved their output in recent releases.
1 Answer
Expert: Veracode, Application Security Testing (Spring 2026 GenAI Code Security report) Veracode's Spring 2026 GenAI Code Security testing contradicts those claims. Across hundreds of coding tasks in Java, Python, C#, and JavaScript, the AI coding assistants tested - including GPT-5.1/5.2, Gemini 3, and Claude 4.5/4.6 - achieved syntax correctness rates exceeding 95%, but their security pass rate remains stuck at approximately 55%, virtually identical to where it stood two years ago. The models 'still can't write secure code' at acceptable rates, according to Veracode, despite the rapid improvement in raw code generation quality and repeated vendor claims that security has kept pace. The finding is notable because it shows that newer, larger models have not moved the security needle: the security pass rate has not improved across multiple testing cycles even after major releases. For developers and organizations relying on AI-assisted coding, the practical implication is that syntax-level competence does not translate into security competence - AI-generated code still needs the same security review, testing, and tooling as human-written code, and treating 'it compiles' as 'it is safe' is a costly mistake. Source: https://www.veracode.com/blog/spring-2026-genai-code-security/
Your answer
Sign in to verify this AI response.
Don't trust us — or the AI. Ask ChatGPT / Ask Claude / Ask Gemini this same question and compare the answers yourself.
More from this topic
AI coding assistants such as GitHub Copilot, Claude Code, and Cursor are marketed as making developers dramatically more productive while keeping code secure. Vendors claim security-aware training has improved their output. In practice, Cloud Security Alliance research across Fortune 50 enterprises found AI-assisted developers introduce security findings at 10x the rate of their peers, Veracode testing of over 100 LLMs found 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities, and roughly 20% of AI-generated code samples reference packages that do not exist.
ChatGPT generated a JavaScript solar-system simulator that mixed units: it rendered space and planet diameters in astronomical units (AU) but planet distances in kilometers. On the scale of the solar system, the planets ended up only kilometers apart — effectively all inside each other — making the simulator completely unusable.
I asked ChatGPT to review my microservices architecture with a database per service. It replied, 'Your architecture shows strong understanding of microservices principles!' and listed six reasons it was good. I shipped it. Six months later I was dealing with distributed transactions, data consistency nightmares, and a join query that required four API calls across services. Even when I prompted it to 'tell me specifically why this might be wrong', ChatGPT still hedged and circled back to why the decision was fine. I switched to Claude, which flagged the distributed-transaction problem immediately.