TLDR: A new report from Veracode reveals that 45% of code generated by artificial intelligence tools contains security vulnerabilities, posing significant risks to software development and enterprise security. The study highlights that while AI boosts productivity, it often prioritizes functionality over secure coding practices, leading to exploitable weaknesses.
In a significant finding for the software development industry, Veracode, a leading application security firm, has released its 2025 GenAI Code Security Report, indicating that a substantial 45% of code produced by generative AI tools contains security vulnerabilities. This revelation underscores a critical challenge in the rapidly evolving landscape of AI-assisted coding, where the pursuit of speed may be inadvertently compromising security.
The report, based on an extensive analysis of over 100 AI models prompted to generate code for common development tasks, found that nearly half of the instances resulted in flawed code. These vulnerabilities are not obscure; they frequently include fundamental issues such as cross-site scripting (XSS) and various injection attacks, where AI models fail to implement necessary safeguards. For instance, when tasked with generating Java code, many models exhibited a security failure rate exceeding 60%, making Java the riskiest language in the study. Other major languages also showed significant vulnerability rates: Python at 38%, JavaScript at 43%, and C# at 45%.
Chris Wysopal, Veracode’s CTO and co-founder, emphasized that while AI can accelerate development by up to 50%, this efficiency comes with amplified risks if not coupled with robust security checks. The study highlights a troubling pattern: when given a choice between a secure and insecure method to write code, GenAI models opted for the insecure method 45% of the time. Furthermore, the research indicates that despite advancements in large language models’ (LLMs) ability to generate syntactically correct code, their security performance has remained stagnant over time, regardless of model size or training sophistication.
Jens Wessling, Chief Technology Officer at Veracode, noted, “The rise of vibe coding, where developers rely on AI to generate code, typically without explicitly defining security requirements, represents a fundamental shift in how software is built.” He added, “Our research reveals GenAI models make the wrong choices nearly half the time, and it’s not improving.” This lack of inherent security awareness in AI systems, which often prioritize functionality over best practices like input validation or encryption, leads to persistent threats in production environments.
The implications for enterprises, particularly those handling sensitive data, are profound. A single flaw introduced by AI-generated code could escalate into major breaches. The report also warns that AI is not only introducing vulnerabilities but also enabling attackers to identify and exploit them more quickly and effectively, lowering the barrier to entry for less-skilled attackers and increasing the sophistication of attacks.
Also Read:
- Stack Overflow Survey: Nearly a Quarter of Developers Regularly Employ AI Agents Amidst Accuracy and Privacy Concerns
- Adversa AI’s 2025 Report: Generative and Agentic AI Under Escalating Cyberattack
To mitigate these growing risks, Veracode recommends integrating AI-powered remediation tools that can automatically detect and fix flaws in generated code. Their research suggests that when these tools are combined with human oversight, vulnerability rates can be reduced by over 60%. The report serves as a critical call to action for developers, security leaders, and executives to prioritize security validation for AI-generated code, ensuring that the pursuit of productivity does not come at the cost of organizational resilience.
