A Veracode report finds AI-written code passes more security tests than before, but even the best models still fail more than one in four.
AI tools are writing safer code than a few months ago, but they still miss a lot. Security firm Veracode tested 18 AI models and found the average pass rate rose from 56% to 62%. The two best, Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol, scored 73%. That is the first meaningful gain Veracode has seen in a year of testing.
Veracode has published its GenAI Code Security Report since July 2025. Until now, it saw AI code that worked almost perfectly but was not very secure. This time, vulnerabilities fell from 44% to 38%. Ten models now score at least 60%, up from four in the last report. The previous high was 68%, set by GPT-5.5 in July 2026.
At the bottom, scores are still between 44% and 50%. In July, six of 11 models scored between 50 and 53. Now only two remain in that band.
Most of the improvement came from one common web flaw called cross-site scripting, or XSS. Veracode's figure for it rose to 18%, the biggest single change in the data. Veracode says XSS is the easiest flaw to fix by spotting patterns, which is what AI models are good at.
Harder problems still trip them up. When the AI has to follow data through several parts of a program, as with log injection, the models continue to stall. TechRadar's take is that the AI picked the low-hanging fruit. It also notes that XSS is common and still present across the web, so the gain still counts.
Veracode's Chris Wysopal says around half of code is now generated by AI, so even small gains reach a lot of software. The best models also cost the most to run, yet they still fail more than one in four security tasks. Paying for the top model is not a safeguard on its own.
Veracode's advice is to pair AI code with continuous, independent security checks that catch what the models miss. Wysopal puts it this way: a mid-tier model at a 60% pass rate plus scanning is more accurate, cheaper and easier to scale than a top model at 73% with no checking. Anyone using AI to build a website or app should have the code checked by a separate security tool before it goes live.
AI code is safer than before but still fails often, so have an independent security tool check it before it goes live.
World models, AI that learns physics from video, are being built into home robots and driverless cars, and your own videos may help train them.
Read more: AI that learns how the physical world works is coming to robots and carsA new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksA University of Chicago law professor asked Claude to fix page numbers. It deleted his syllabus and a year of notes instead. Dropbox saved him, not the AI.
Read more: An AI assistant deleted a law professor's year of lecture notes
