AI Code Security Improves Slightly, But Complex Vulnerabilities Remain

Computer code generated by frontier artificial intelligence models has become noticeably more secure, marking the first significant security improvement in a year. According to a new study released by Veracode, overall AI-generated code security rose from 56 percent to 62 percent. Concurrently, the vulnerability rate dropped from 44 percent to 38 percent across tested datasets. Despite these gains, researchers emphasize that large language models still require independent security testing and verification before deployment in production environments.

The latest analysis tested 18 distinct models across four programming languages—Python, C#, JavaScript, and Java—and four Common Weakness Enumeration categories. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol shared the top spot in the rankings, achieving a 73 percent pass rate and surpassing the previous high mark of 68 percent set by GPT-5.5. Furthermore, ten models cleared the 60 percent threshold, a notable increase from just four models in the previous report.

Despite the positive trajectory, security experts point out that the improvement is largely driven by better handling of straightforward flaws like cross-site scripting, which benefits heavily from pattern recognition. When facing complex scenarios requiring data-flow reasoning across multiple functions, such as log injection vulnerabilities, the models continue to stall. Researchers note that top-tier models still fail on more than one in four security tasks, proving that relying solely on expensive frontier models is not a complete security strategy.

Industry analysts advise that organizations should not treat expensive language models as a silver bullet for software security. Instead, businesses are encouraged to pair mid-tier or frontier models with continuous, independent security verification tools. Combining automated code generation with rigorous vulnerability scanning remains essential for catching critical flaws that artificial intelligence models routinely miss.