AI coding assistants outpace security checks as half of committed code is AI-generated, TechRadar reports

In an article by Chris Wysopal, chief security evangelist at Veracode, TechRadar said AI-generated code achieves a 99.9% pass rate for syntactic correctness. The average security pass rate is 56%, meaning about 44% of tested code-generation tasks introduce a known vulnerability. Software vulnerabilities are now the top breach entry point at 31%, overtaking stolen credentials, the article said.

Model choice is a security decision, according to the article. AI models learn from large volumes of historical and public code, including open-source projects and developer communities; that data contains secure implementations but also outdated libraries, weak validation and insecure coding patterns. The strongest model tested achieved a 68% security pass rate, while six of the 11 models clustered between 50% and 53%. The article said choosing a stronger model can reduce exposure but does not make output trustworthy by default, and AI-generated code should still be tested through the software development lifecycle with static analysis and enforceable security policies.

Security performance varies widely by vulnerability type, which the article said shows why application context matters. Models achieved pass rates of 83% for SQL injection and 87% for insecure cryptographic algorithms, but performance fell to 15% for cross-site scripting and 12% for log injection. Some weaknesses can be caught through a recognizable coding pattern, while others depend on data flows, authorization, trust boundaries and how parts of an application interact. The article said AI-native analysis can add contextual risk detection alongside established static analysis, surfacing issues such as logic flaws and broken authentication in pull requests, and that contextual analysis should be combined with independent testing before code is merged.

Security debt is already widespread. The article said 82% of organizations are affected by security debt, and 60% by critical security debt. As AI increases the volume and speed of software development, it also increases the amount of risk security teams must assess, prioritize and remediate, adding pressure to backlogs of unresolved vulnerabilities. The article said teams should focus on exploitability, application criticality and business impact to direct limited remediation capacity toward vulnerabilities most likely to cause real harm. It also said AI-powered remediation can help close the gap between discovery and action by proposing fixes inside the developer workflow.

Wysopal wrote that closing the gap requires making security part of the development process from the start, choosing models with risk in mind and verifying code in context before it reaches production. The goal is not to slow developers down but to make sure security can operate at the same speed and scale as the software being created, the article said.