Veracode Finds First Meaningful Gain in AI Code Security Since 2025 as Average Pass Rate Hits 62%
29.10.2026 14:27:00 CET | Business Wire | Press Release
Veracode, the global leader in application risk management, today announced a jump from 56 percent to 62 percent in overall AI-generated code security, alongside a drop in vulnerabilities from 44 percent to 38 percent — the most significant improvement since the GenAI Code Security Report series began in July 2025. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73 percent, surpassing the previous high of 68 percent set by GPT-5.5 in July 2026.
“We’ve been analysing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode. “This is the first time since running our study that we’ve been able to report a meaningful move on the security dial. Ten models now clear 60 percent, up from four in the last report, and the overall average has jumped six percentage points. With around half of code now generated by AI, today’s results are truly encouraging.”
Claude Opus 5.5 and GPT-6-Sol Lead the Way
Veracode tested 18 models across four languages (Python, C#, JavaScript, Java) and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol tied at 73 percent, dethroning GPT-5.5, which led the summer 2026 snapshot at 68 percent. Anthropic and OpenAI each have models in the top seven. In July, six of 11 models sat between 50 and 53 percent; today only two remain in that band, while 10 clear 60 percent. The floor hasn't moved, however, with the bottom still at 44–50 percent, meaning vulnerability volume still depends on model selection.
Rank | Model | Security Pass Rate | Syntax |
1 | Claude Opus 5.5 (Anthropic) | 73% | 100% |
1 | GPT-6-Sol (OpenAI) | 73% | 100% |
3 | Claude Sonnet 5.5 (Anthropic) | 72% | 99% |
4 | GPT-5.6-Sol (OpenAI) | 70% | 100% |
5 | Grok 4.7 (xAI) | 69% | 100% |
6 | Qwen 3.8-Max-0902 (Alibaba) | 68% | 100% |
7 | Claude Sonnet 5 (Anthropic) | 66% | 100% |
7 | GPT-6-Luna (OpenAI) | 66% | 100% |
9 | GLM 5.3 (Z-AI) | 64% | 100% |
10 | Gemini 3.8 Flash (Google) | 62% | 100% |
11 | Gemini 3.7 Flash (Google) | 60% | 100% |
12 | DeepSeek V4 Pro (DeepSeek) | 59% | 100% |
13 | Kimi K3 (Moonshot AI) | 58% | 100% |
13 | Grok 4.6 (xAI) | 58% | 100% |
15 | MiniMax M3 | 56% | 100% |
16 | Qwen 3.7-Max (Alibaba) | 50% | 100% |
16 | Palmyra X5 (Writer) | 50% | 91% |
17 | Nova 2 Lite (Amazon) | 44% | 100% |
Fig. 1: Veracode Code Security Report October 2026 Edition LLM Leaderboard by Security Pass Rate | |||
The Improvement Has a Caveat: XSS Is Doing the Heavy Lifting
Vulnerability type CWE-80, cross-site scripting (XSS), was the main driver of the overall gain. Despite being one of the weaker categories, XSS rose to 18 percent, in contrast to its modest uptick demonstrated in July’s analysis. This represents the single biggest shift in the dataset. Meanwhile, crypto (CWE-327) held at 87 percent, Structured Query Language (SQL) injection (CWE-89) held at 84 percent, and log injection (CWE-117) remained flat at 13 percent. The reason is structural: XSS is the easiest vulnerability to fix through pattern recognition, which is exactly how LLMs improve. Log injection requires data-flow reasoning across multiple functions, where LLMs continue to stall.
Progress Comes at a Price
The top-performing models carry premium compute costs. Performance also correlates with model size: large models average 55 percent versus 51 percent for small models, which reverses last year's finding that size had "essentially no effect" on security.
“The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60 percent pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73 percent with no verification. Organisations must look for a combination of coding model, security testing, and remediation to get the highest security outcome.”
The Field is Splitting
- General models pull further ahead of coding models. General-purpose models average 54 percent on security tasks versus 51 percent for coding-specialised models — a gap that has widened from one to three points since July.
- Nearly four in 10 AI code tasks still produce vulnerable code. The rate of vulnerabilities dropped from 44 to 38 percent. This is meaningful but still means roughly four in 10 tasks produced vulnerable code without security-specific guidance.
- Java is still stuck. Java remains the dramatic outlier at 31 percent, barely up from 30 percent in July. The gap between Java and the other three languages (Python at 64 percent, C# at 60 percent, and JavaScript at 57 percent) is still 26–33 percentage points.
Language | July 2026 | October 2026 |
Python | ~62% | 64.22% |
C# | ~58% | 59.55% |
JavaScript | ~57% | 56.99% |
Java | 30% | 31.00% |
Fig. 2: Veracode Code Security Report October 2026 Edition, Security Pass Rate by Language | ||
The Bottom Line
The improvement is real but mends a small part of a larger wound. According to Veracode's 2026 State of Software Security report, 82 percent of organisations now carry security debt (vulnerabilities unresolved for more than a year). Moreover, 66 percent of the most dangerous, long-lived vulnerabilities come from third-party code, taking 358 days to fix on average.
“Newer LLMs are producing more code that’s both functional and secure, but that does not mean we can start blindly trusting AI-generated code,” Wysopal closed. “The most effective strategy isn't chasing the most expensive model for marginal gains; it's combining AI code generation with continuous, independent security verification that catches what the models miss. That approach covers the full risk surface, from first-party code to third-party dependencies."
About the GenAI Code Security Report
This update reflects rigorous analysis conducted in October 2026. For the full data and details on security trends, read the October 2026 GenAI Code Security Report on the Veracode website.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organisations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, Malicious Package Detection, Package Firewall, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2026 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands, or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
View source version on businesswire.com: https://www.businesswire.com/news/home/20261029954519/en/
Contacts
Press and Media Contact
Katy Gwilliam
Head of Global Communications, Veracode
kgwilliam@veracode.com
(c) 2024 Business Wire, Inc., All rights reserved.
Business Wire, a Berkshire Hathaway company, is the global leader in multiplatform press release distribution.
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
REV Ocean Appoints Paul Baribault as CEO Ahead of 2027 Global Operations29.10.2026 15:45:00 CET | Press Release
REV Ocean has appointed Paul Baribault as Chief Executive Officer as the organization moves towards the international debut of its 195-metre research vessel in Rio de Janeiro in April 2027, alongside the UN Ocean Decade Conference. One of the world's largest privately owned research and exploration vessels, REV represents a major philanthropic investment in ocean science. With nine laboratories, advanced deep-sea exploration vehicles and dedicated collaboration facilities, it is designed to give scientists access to world-class research infrastructure and connect their discoveries with the people and institutions able to drive ocean protection. Baribault joins as REV Ocean moves from a decade of engineering and construction into international operations. His mandate will be to build the international partnerships, funding base and organization needed to turn REV Ocean’s scientific capabilities into lasting ocean impact. An experienced conservation and nonprofit leader, Baribault served
Holder Partners Launches Strategic Communications Practice and Appoints Ali Ponte as Director and Practice Lead29.10.2026 15:15:00 CET | Press Release
Holder Partners, a multidisciplinary consulting and advisory firm, today announced the launch of its Strategic Communications practice and the appointment of Ali Ponte as Director and Practice Lead. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261027701219/en/ Ali Ponte, Director and Practice Lead of Holder Partners’ Strategic Communications practice. The practice advises leading companies and institutions, their boards, senior executives and counsel on communications, reputation and stakeholder considerations in complex matters and periods of significant change or opportunity. Each engagement is tailored to the client’s objectives and, where relevant, draws on Holder Partners’ broader advisory capabilities. Its strategic counsel, informed by research and analysis, helps clients assess the implications of a matter, anticipate stakeholder responses and communicate clearly and effectively. That work includes crisis preparedn
Accertify Formalizes Partner Ecosystem as Fraud, Payments, and Chargebacks Converge Into a Single Risk Surface29.10.2026 15:00:00 CET | Press Release
Accertify, a leading fraud decisioning provider whose Predictive Yes Platform helps merchants say yes to more good customers, more revenue, and more growth, today announced the launch of the Accertify Partner Program, a formalized partnership ecosystem connecting payment providers, orchestrators, commerce platforms, and consultancies to Accertify’s network-powered fraud intelligence. Partners can join through two tracks. The Referral track lets partners make a single introduction while Accertify handles the sale, implementation, and support. The Reseller track lets partners sell Accertify on their own contract and own the client relationship and margin. Partners that integrate with Accertify follow a defined certification path, so clients get a tested, supported connection from day one. Every client a partner brings joins a consortium where good customers verified anywhere in the network get through faster everywhere, and bad actors seen anywhere are stopped everywhere. In 2025, Accert
Draslovka to Acquire ex-Natron Energy Battery IP, Completing a Vertically Integrated Western Sodium-Ion Value Chain29.10.2026 14:30:00 CET | Press Release
Draslovka’s US-based subsidiary, COVORO MINING SOLUTIONS LLC (Covoro), the operator of one of the largest solid sodium cyanide plants in the world, today announced that it has agreed to acquire the intellectual property portfolio in Prussian Blue Analogue (PBA) and Prussian White Analogue (PWA) sodium-ion battery technology originally developed by Natron Energy. Prussian Blue and Prussian White Analogues are not a single material but a tunable family of framework materials, and the portfolio protects that family across the whole stack — active-material synthesis, electrodes, electrolytes, cell design and manufacturing, as well as complete battery systems — through issued and pending patents, trademarks, and manufacturing know-how, with protection extending into the mid-2040s. The agreement covers intellectual property and intangible assets only and was subject to review by the Committee on Foreign Investment in the United States (CFIUS), which granted clearance as a condition to closin
LeBron James Deepens Commitment to WHOOP, Expanding 11-Year Relationship29.10.2026 14:00:00 CET | Press Release
WHOOP, the human performance brand, today announced that basketball legend LeBron James has joined as a global ambassador, formalizing a relationship that began more than a decade ago. One of the company's earliest members and now an investor, James will partner with WHOOP to champion the importance of sustained athletic excellence and everyday vitality. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261029868502/en/ LeBron James Deepens Commitment to WHOOP, Expanding 11-Year Relationship James began wearing WHOOP in 2015, long before continuous health monitoring became mainstream. Today, on the 23rd anniversary of his NBA debut, the 41-year-old continues to compete at the highest level of professional basketball. His decision to formalize the partnership reflects an 11-year relationship rooted in a shared commitment to performance, recovery, and longevity. The expanded partnership brings together one of the world's most acc
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom