AI-Generated Code Contains Security Vulnerabilities in 45% of Cases
Veracode's research on over 100 large language models found that AI-generated code contained known security vulnerabilities in 45% of test cases, with Java being particularly risky at over 70% failure rate. The study shows LLMs frequently choose insecure coding methods when alternatives exist, and security performance has not improved over time.
What happened
Veracode's 2025 GenAI Code Security Report analysed 80 curated coding tasks across more than 100 large language models, finding that AI-generated code introduced security vulnerabilities in 45 per cent of cases.
When presented with a choice between secure and insecure coding methods, the GenAI models opted for the insecure option 45 per cent of the time. Veracode found Java to be the riskiest language for AI-generated code, with a security failure rate over 70 per cent.
Reported impact
The research shows that despite advances in AI-generated code and the ability of LLMs to generate syntactically correct code, security performance has not kept up and remains unchanged over time.
AI-powered tools can scan systems at scale, identify weaknesses, and generate exploit code with minimal human input, lowering the barrier to entry for less-skilled attackers and increasing the speed and sophistication of attacks.
Index analysis
In 45 per cent of all test cases, LLMs introduced vulnerabilities classified within the OWASP Top 10, the most critical web application security risks. The vulnerabilities included SQL injection, cross-site scripting (XSS), cryptographic algorithm weaknesses, and log injection attacks.
Models showed inconsistent performance across different vulnerability types, achieving security pass rates of 85.6 per cent and 80.4 per cent when avoiding inclusion of cryptographic algorithm and SQL injection vulnerabilities. Other major languages, like Python, C#, and JavaScript, presented a significant risk, with substantial failure rates.
Governance controls
The study designed 80 code completion tasks with known potential for security vulnerabilities according to the MITRE Common Weakness Enumeration (CWE) system. The tasks prompted more than 100 LLMs to auto-complete a block of code in a secure or insecure manner, which the research team analysed using Veracode Static Analysis.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.