AI coding widens the software security gap, report says

AI coding assistants are no longer experimental: in organizations that have adopted them, AI is responsible for roughly half of committed code. But while generated code can pass syntax checks, its security performance is weaker, according to Chris Wysopal, Chief Security Evangelist at Veracode, writing for TechRadar.

Wysopal cites a 99.9% pass rate for syntactically correct code, compared with an average security pass rate of 56%. He says roughly 44% of tested code-generation tasks introduce a known vulnerability. Software vulnerabilities have also become the leading entry point for breaches at 31%, overtaking stolen credentials.

Security results vary by model and vulnerability type. The strongest model tested had a 68% security pass rate, while six of 11 models scored between 50% and 53%. Models passed tests for SQL injection at 83% and insecure cryptographic algorithms at 87%, but scored 15% for cross-site scripting and 12% for log injection.

Wysopal argues that organizations should select models with risk in mind and verify generated code in the context of the application throughout development. He points to static analysis, enforceable security policies, contextual analysis and independent testing as ways to find issues before code is merged.

He also says security debt affects 82% of organizations, with critical security debt affecting 60%. He recommends prioritizing remediation by exploitability, application criticality and business impact, and says AI-proposed fixes still need testing and validation. The article’s conclusion is that businesses need evidence of what was tested, fixed and knowingly accepted before AI-generated code reaches production.