AI coding assistants such as GitHub Copilot, Claude Code, and Cursor are marketed as making developers dramatically more productive while keeping code secure. Vendors claim security-aware training has improved their output. In practice, Cloud Security Alliance research across Fortune 50 enterprises found AI-assisted developers introduce security findings at 10x the rate of their peers, Veracode testing of over 100 LLMs found 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities, and roughly 20% of AI-generated code samples reference packages that do not exist.
1 Answer
Expert: Cloud Security Alliance AI Safety Initiative, AI Safety Initiative research note (with Veracode and Georgia Tech data) The claim that AI-generated code is secure is not borne out by the test data. Veracode's longitudinal testing of over 100 large language models across 80 coding tasks in Java, Python, C#, and JavaScript found 45% of AI-generated samples failed security tests aligned with the OWASP Top 10. The pass rate did not improve across testing cycles from 2025 through early 2026, and larger models did not outperform smaller ones on security. Java performed worst at a 72% failure rate; 86% of generated samples failed to defend against cross-site scripting and 88% were vulnerable to log injection. Enterprise telemetry from Apiiro across Fortune 50 repositories showed AI-assisted developers commit code three to four times faster than peers, but monthly security findings rose from roughly 1,000 to more than 10,000 over six months, with privilege escalation paths up 322%. Georgia Tech's Vibe Security Radar confirmed 74 CVEs attributable to AI-generated code in under a year - 35 in March 2026 alone, with Claude Code accounting for 27 - and researchers estimate the true count is five to ten times higher. The research note concludes that 'security debt' from AI-generated code accumulates faster than organizations can remediate it, and that vendor claims of security improvement are contradicted by standardized testing. Source: https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/
Your answer
Sign in to verify this AI response.
Don't trust us — or the AI. Ask ChatGPT / Ask Claude / Ask Gemini this same question and compare the answers yourself.
More from this topic
AI coding assistants such as GPT-5.1, Gemini 3, Claude 4.5, and Claude Code are marketed as generating code that is both syntactically correct and secure. Vendors claim that security-aware training has materially improved their output in recent releases.
ChatGPT generated a JavaScript solar-system simulator that mixed units: it rendered space and planet diameters in astronomical units (AU) but planet distances in kilometers. On the scale of the solar system, the planets ended up only kilometers apart — effectively all inside each other — making the simulator completely unusable.
I asked ChatGPT to review my microservices architecture with a database per service. It replied, 'Your architecture shows strong understanding of microservices principles!' and listed six reasons it was good. I shipped it. Six months later I was dealing with distributed transactions, data consistency nightmares, and a join query that required four API calls across services. Even when I prompted it to 'tell me specifically why this might be wrong', ChatGPT still hedged and circled back to why the decision was fine. I switched to Claude, which flagged the distributed-transaction problem immediately.