Ai-generated code is measurably worse at security and we're shipping it anyway. veracode puts the…
ai-generated code is measurably worse at security and we're shipping it anyway. veracode puts the security pass rate at 56%, apiiro found cvss 7+ flaws at 2.5x the rate of human code, and hallucinated package names spawned a supply-chain attack called slopsquatting.
the review loop became the whole security model.
Context
Verified source: Veracode's 2026 GenAI Code Security Report, dated Jul 27, 2026, tested 11 new models on 80 tasks and puts the average security pass rate across more than 100 models at 56%, barely changed from 55% in its first report. Veracode's blog says about 44% of tasks introduced a risky vulnerability.
The Next Web (Jul 28) reports the same 56% figure.
The 56% pass rate matches Veracode, though the report is from July and the figure has been flat for two years rather than newly measured. Apiiro's finding of CVSS 7-plus flaws at 2.5 times the human rate, and the slopsquatting supply-chain attack, were not seen in the sources read, so unsupported here, not refuted. 'Measurably worse' is Veracode's own framing of a flat rate. Veracode sells code security tools. 'The review loop became the whole security model' is the author's opinion.
Related work
- Spring 2026 GenAI Code Security Update, Veracode ↗Mar 24, 2026. About 55% pass rate.
- Veracode report page ↗Jul 27, 2026.
- The Next Web ↗Jul 28, 2026.
Watch next
- Look up Apiiro's research for the 2.5x figure and a primary source for slopsquatting.
Sources
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 1 October 2026 at 02:05 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →