AI-generated code is still frequently failing security checks with Claude
and GPT-6 topping the leader board

Date:
Fri, 30 Oct 2026 18:10:00 +0000

Description:
Progress is there, but it's mending a small part of a large wound.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter AI-generated code security improved for the first time in a year, with vulnerability rates dropping from 44% to 38% Top models performed better at preventing common flaws like XSS, but still struggled with complex security reasoning Researchers stress AI-generated code still requires independent security testing and
verification before deployment Computer code generated by frontier AI models has gotten more secure and consequently - contains fewer vulnerabilities.

This is according to a new report by Veracode, which claims this is the first significant improvement in a year. In July 2025, Veracode started releasing its GenAI Code Security Report, which analyzed code generated by LLMs for vulnerabilities and security risks. Since then, the companys researchers noticed a trend - the code was functioning almost perfect, but on the
security side it left much to be desired. Latest Videos From TechRadar Watch full video here: Are XSS flaws worth the trouble? Weve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen
a marked improvement in AI code security, despite consistently near-perfect functionality, said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode.

This is the first time since running our study that weve been able to report
a meaningful move on the security dial. You may like Why AI coding is
widening the software security gap Shock horror AI-generated security
patches fall short of actually solving all the problems they were meant to
fix AI is changing security testing, but not all vulnerabilities are created equal

That meaningful move is a jump from 56% to 62% in overall AI-generated code security. At the same time, theres been a drop in vulnerabilities from 44% to 38%, Veracode added, saying this was the most significant improvement since the reports started coming out. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73%, surpassing the previous high of 68%
set by GPT-5.5 in July 2026.

Ten models now clear 60%, up from four in the last report, and the overall average has jumped six percentage points, Wysopal said. With around half of code now generated by AI, todays results are truly encouraging. Are you a
pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

To draft the report, Veracode tested 18 models across four languages (Python, C#, JavaScript, and Java), and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol claimed the top spot with 73% followed by GPT-5.5 which holds 68%. In July, six of 11 models scored between 50 and 53, while today only two remain in
that band, while 10 scored at least 60%. The bottom is still at 44% - 50% percent.

While the results are definitely commendable, there is a caveat. Apparently, the main driver of the overall gain was on cross-site scripting (XSS), which is arguably one of the weakest categories. XSS rose to 18% which is also the single biggest change in the dataset. According to Veracode, XSS is the easiest vulnerability to fix through pattern recognition, which is exactly
how LLMs improve. In cases where data-flow reasoning across multiple
functions is required (such as, in log injection cases, for example), LLMs continue to stall. Low-hanging fruit In other words, AI has just picked low-hanging fruit and called it a day. Were not sure if we should be disappointed with this, since XSS attacks are common and the vulnerability is still present across the web. What to read next Claude flags nearly 500 worrying open source security issues C, Java, and Python code all at risk as one flaw wasn't spotted for 21 years Ghosts in the machine: AI malware shows why it is time to extend Zero Trust to code AI coding is putting software
risk on steroids

In the report, Veracode also said that water was wet and the sky is mostly blue: it found that top-performing models cost more.

However, they said throwing money at the problem most likely isnt the best solution: The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks, Wysopal said. The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60% pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73% with no verification.

In conclusion, the improvement is there, but mends a small part of a larger wound, Veracode said. Organizations should make sure they combine AI code
with continuous and independent security verification that can catch what the models miss. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/ai-generated-code-is-still-frequently-f ailing-security-checks-with-claude-and-gpt-6-topping-the-leader-board


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)