// SECURITY
Why does so much AI-generated code ship with security holes?
Updated 2026-08-11 · 4 min read
Veracode’s 2025 GenAI Code Security Report found that when there is a secure and an insecure way to write something, AI models choose the insecure one 45% of the time, across 80 tasks and 100+ models. AI is trained to produce code that works, not code that is safe, and getting bigger has not fixed it.
What the research found
Across 80 curated tasks and more than 100 large language models, models picked the insecure implementation 45% of the time. For cross-site scripting specifically, they failed to defend against it in 86% of relevant samples. Security performance stayed flat regardless of model size, even as functional correctness improved.
Why it happens
Models learn from vast amounts of public code, much of which is insecure, and they optimize for "does it run," not "is it safe." Veracode also reports AI-generated code carries about 2.74x more vulnerabilities than human-written code.
What it means for your app
If you shipped a vibe-coded app without a security review, the base rate says roughly half the security-relevant decisions may have gone the wrong way. That is not a reason to stop building with AI, it is a reason to check the output.
What to do about it
- Run a security scan before you take real users or payments.
- Focus first on the highest-impact holes: RLS, exposed keys, access control, payments.
- Use the fix, not just the finding, apply the exact change and re-scan.
Key takeaways
- AI picks the insecure option 45% of the time (Veracode 2025).
- AI-generated code has ~2.74x more vulnerabilities than human code.
- Bigger models did not get safer, review the output before launch.
Sources
Frequently asked
Should I stop using AI to build?
No. AI is great for shipping fast. The takeaway is to add one step, a security check, before real users or payments, because the tool will not do it for you.