AI-generated code is still frequently failing security checks — with Claude and GPT-6 topping the leader board

AI-generated code security has seen a slight improvement for the first time in over a year, according to a new Veracode report. The vulnerability rate dropped from 44% to 38%, with top models like Claude Opus 5.5 and GPT-6-Sol performing well in preventing common flaws such as XSS attacks. However, complex security reasoning remains a challenge for AI-generated code.

Researchers stress that AI-generated code still needs independent security testing and verification before deployment. While the overall security score improved from 56% to 62%, most of the progress was due to advancements in handling XSS flaws, which are relatively easy to fix through pattern recognition. The study analyzed 18 models across four programming languages and four Common Weakness Enumeration categories, finding that top models now score above 60%, a six percentage point increase from the previous report.

However, the improvement is still limited, as the majority of AI-generated code still contains vulnerabilities, and the best models are more expensive, making them less scalable for widespread use.