Research: AI-Generated Code Contains Average 15 Security Vulnerabilities Per Codebase
Secure Code Warrior research found that large language models generate code averaging 15 security vulnerabilities per codebase, with patterns that are predictable and vary by model and development framework. Updated security guidance emphasizes that AI-generated code requires the same rigorous review and testing as manually written code.
What happened
Secure Code Warrior released the SCW AI Trust Index, a benchmark system assessing security risks in code generated by large language models. The research evaluated 1,760 complete codebases generated by 16 models from OpenAI, Anthropic, Google, and Alibaba, based on methodology developed by Royal Melbourne Institute of Technology.
The study found that AI-generated code averaged 15 confirmed security vulnerabilities per codebase, with 4.3 classified as 'severe' level. Analysis identified 86 different Common Weakness Enumerations (CWE), with CWE-532 (writing sensitive information to log files) appearing most frequently at 8,543 instances.
Reported impact
The research shows security risks from AI-generated code are predictable and measurable rather than random. Each AI model exhibits a distinct 'security fingerprint' with reproducible vulnerability patterns that vary by model and development framework.
Index analysis
The Center for Internet Security and SAFECode updated the Secure by Design guidance (version 1.1) in July 2026 to address AI-generated code, requiring that such code undergo the same security analysis, review, and testing as human-written code. The guidance emphasizes that AI should assist the development process rather than replace existing code review, security analysis, and testing procedures.
Governance controls
Secure Code Warrior's SCW AI Trust Index provides enterprises with comparative security data across different models, identifies recurring vulnerability patterns, and enables quantified risk assessment of AI-generated code. The index establishes a dynamic benchmark system that updates as new models emerge.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.