Your AI Assistant Ships Insecure Code Almost Half the Time. Catching It in Review Is Too Late.

By Sangyeon Park — creator of Cencurity, an open-source security gateway for LLM coding agents

In March 2026, Veracode published its Spring GenAI Code Security Update. The team ran more than 150 large language models through 80 code-generation tasks in Java, JavaScript, C#, and Python, then tested every output against four common weakness categories.

The syntax was excellent. Over 95% of the generated code compiled and ran.

The security was not. Forty-five percent of it contained a known vulnerability.

The raw number is not what should worry you. What should worry you is that the number has not moved. Veracode's phrasing is unusually blunt for a vendor report: security pass rates "remain stubbornly stuck at approximately 55%" — virtually identical to where they stood two years ago. Two years of longer context windows, better reasoning traces, and steadily climbing SWE-bench scores, and the security line is flat.