Ask five engineering leaders which AI coding model is "safe," and you'll get five confident, contradictory answers. Veracode's 2026 GenAI Code Security Report gives the question a measured answer: across its benchmark tasks, AI-generated code passed security tests 56% of the time and introduced a risky vulnerability in the other 44%. That's effectively flat from the previous report's 55% pass rate, while Veracode estimates AI now authors roughly half of committed code.
Flat security performance at higher volume isn't a wash. It's the same failure rate landing on more production code.
The plateau nobody's marketing slide mentions
A separate CodeRabbit study reported 2.74x more vulnerabilities in AI-co-authored pull requests than in human-only pull requests, from 470 open-source PRs (320 AI-co-authored, 150 human-only), not from Veracode. CodeRabbit notes an important limitation: authorship was inferred from signals rather than confirmed ground truth.
Different datasets point in the same direction: model capability and secure output don't rise on the same curve.
Vulnerability class matters more than the average
Veracode's aggregate result hides a much sharper spread:
- SQL injection: 83% pass rate
- Cryptographic implementation: 87% pass rate
- Cross-site scripting: 15% pass rate
- Log injection: 12% pass rate
The hard cases require context: where untrusted data entered, how it moved through calls, where it reached a sink. That's a dataflow problem, not a syntax problem.
Model selection is a security decision, not a security control
GPT-5.5 led Veracode's benchmark at 68%. More than half of tested models clustered at 50-53%. Coding-specialized models averaged 51%, general-purpose models 52%, and reasoning models 56% vs. 51% for non-reasoning variants. Model size showed little correlation with security outcomes.
There's no universal "most secure" model. Even the benchmark leader failed nearly one test in three.
What to do with this data this quarter
- Ask for weakness-level evidence, not just an aggregate score.
- Review at the change boundary: local diffs, PRs, trunk commits, while context is fresh.
- Prioritize reachable risk over raw finding counts.
- Record the policy: which models, which checks, who signs off.
The 2026 data doesn't identify a shortcut past review. It makes the case for a review layer that stays useful when the model roster changes.
Full piece, with more on Dromeas's multi-model review pipeline (independent Security, Quality, Compliance, and Bug Tracing analysts), originally published at dromeas.ai: https://dromeas.ai/blog/which-ai-model-writes-most-secure-code
Top comments (0)