Two weeks ago I wrote about what AI code costs you after it is written. One of the numbers in that piece came from Veracode: in their 2025 study, 45 percent of generated code introduced a known security flaw. On 29 October, Veracode published a new edition, and the headline is unusually upbeat. For the first time since the series began in July 2025, they report progress that matters.
I didn’t want to take that from a summary.
What was measured
Veracode had 18 language models write code for programming tasks in Python, C#, JavaScript and Java, then tested the output for four kinds of flaw: SQL injection, weak cryptography, cross-site scripting (XSS) and log injection. The prompts carried no security instruction. The model gets an ordinary request, and Veracode checks whether the answer has a hole in it.
How many tasks there were per language or per category isn’t in the blog post or the press release. That makes it hard to judge how much a shift of a few points really weighs.
The headline numbers: according to Veracode, the average pass rate rose from 56 to 62 percent, and the share of tasks with a flaw fell from 44 to 38 percent. Claude Opus 5.5 and GPT-6-Sol share first place at 73 percent. The bottom of the table still sits between 44 and 50 percent.
This site is built with Claude Code, and Opus 5.5 is the model I use for it. The top score is also a good score for my own tooling. That doesn’t make it wrong, but it’s a reason to read the rest of the report closely.
Where the gain is
Veracode itself writes that the improvement isn’t spread evenly. Per category, July against October:
| Kind of flaw | July 2026 | October 2026 | Movement |
|---|---|---|---|
| Weak cryptography | 87% | 87.4% | flat |
| SQL injection | 83% | 83.7% | flat |
| Cross-site scripting (XSS) | 15% | 18% | up |
| Log injection | 12% | 12.6% | flat |
Two categories were already high and stayed there. Of the two weak ones, one moved and one didn’t. That split is the story.
XSS happens when you put untrusted text into a web page without neutralising it first. The fix is almost always the same pattern: use textContent instead of innerHTML, or let a template engine escape it for you. Modern frameworks do this by default. A model that has seen enough recent code picks the safe route more often on its own. Veracode calls it pattern recognition.
Log injection is a different animal. The question is whether user input, passing through a few functions and maybe a database, ends up in a log file unfiltered. There’s no safe function to call. You have to follow the data through the whole application. According to Veracode, that category has sat around 12 percent in every snapshot of the series, with no sign of recovery.
Chris Wysopal of Veracode put it to TechTarget this way: a model needs to know which inputs come from the user and where they go. In his view, the XSS gains don’t prove that yet.
The number I can’t make add up
Checking the arithmetic, I got stuck. The 62 percent average matches the leaderboard: add up the 18 scores, divide by 18, and you get 62.1. But the breakdowns in the same post come out lower. The four categories average 50.4 percent, the four languages 52.9 percent.
There may be a good reason, such as a different weighting or a different number of tasks per category. It just isn’t stated.
In July Veracode tested 11 models; now it’s 18. Comparing an average over a different set of models with the previous average tells you something about the field, but not necessarily that the same models got better. Part of the jump may simply be newer, stronger models joining the list. And a three-point rise in one of four categories, weighted equally, doesn’t account for even one point on the total. So I can’t fully reconcile the headline with the tables underneath it.
That doesn’t make the report worthless. The direction is consistent, and Veracode itself writes that the headline needs an asterisk. But “six points safer” is a softer number than it looks in a headline.
What this means for my own code
After reading it, I searched this site’s code for exactly those two patterns.
The search feature, built on 17 October, writes results into the page with textContent everywhere but one spot. That one uses innerHTML, with a one-line comment saying the search library escapes the text itself and only wraps the search term in a highlight. That’s the safe pattern as the default, with one deliberate exception. It’s also an assumption about someone else’s library, and none of Veracode’s tests would catch that kind of assumption.
The worker that stores waitlist sign-ups logs only the error message on failure, never the submitted address. The address also has to pass a check that rejects spaces and line breaks. So log injection can’t happen there. But I know that because I followed the address all the way through, which is exactly the work this report says the models aren’t getting better at.
The caveat
The safest code comes from the most expensive model. For the first time, Veracode sees larger models scoring higher: 55 percent on average against 51 for small ones. If you want secure code without looking at it yourself, you pay for that per token. Security moves from something you do to something you buy, and most people don’t make that choice consciously.
Responsibility shifts to the part that isn’t improving. As the model avoids the easy flaws more often by itself, the humans are left with the hard ones: the data flow through five functions, the assumption about a library. A reviewer who notices the familiar mistakes are gone looks a little less sharply. The hardest work lands with the person who is least alert.
Whoever measures it sells the fix. Veracode sells scanners. The same post concludes that a mid-tier model plus their scanner beats a top model without verification. That may be true, but the report is also a sales argument, and the weighting behind the headline number isn’t published.
What I do
I don’t treat this report as a reason to check less. The seven checks this site runs before every deploy look at text, numbers and scheduling. None of them looks at security. That was a deliberate choice for a static site, but with a waitlist and a search feature, the site isn’t entirely static anymore.
What I do for every change that accepts outside input: follow that input to wherever it ends up, and give every exception to the safe pattern a one-line comment saying why. I write that comment for myself, six months from now.
Frequently asked questions
Is AI-written code now safe enough to use without review?
No. Even the best model in this study introduces a flaw in more than a quarter of the tasks, and on average nearly four in ten tasks contain one. The improvement also sits mostly in the kind of flaw that was already easiest to find.
Does it help to ask the model for secure code?
Veracode deliberately tested without a security instruction, so this report says nothing about that. It does say something about the default: what you get when you don’t ask. For log injection an instruction probably helps less, because the model would need to see the data’s entire route.
Why does Java score so much worse?
Java sits at 31 percent according to Veracode, against 57 to 64 for the other three languages. The report doesn’t give a conclusive explanation. It points to the same pattern as with log injection: the improvement stops where pattern recognition stops.
Sources
- Veracode, “GenAI Code Security Fall 2026: The Ceiling Moves, But on the Low-Hanging Fruit”, blog post, 29 October 2026.
- Veracode, press release “Veracode Finds First Meaningful Gain in AI Code Security Since 2025 as Average Pass Rate Hits 62%”, 29 October 2026.
- TechTarget, “Secure code: LLMs improve, but orgs can’t rely on AI for AppSec”, 29 October 2026.
- Veracode, “2025 GenAI Code Security Report”, blog summary, 30 July 2025.
Checked on 30 October 2026, against Veracode’s own blog post and press release. What I couldn’t verify: the number of tasks per category and the weighting behind the 62 percent average, since neither source states them. The calculations in the section on the number I can’t make add up are mine, based on the tables in the blog post. I haven’t checked the search library’s source code to confirm it escapes the text itself. Veracode sells a security scanner and has an interest in AI code needing verification.