AI-generated code security: what the research shows

Updated Oct 26, 2026 · Sources listed at the end

AI-generated code is often insecure: Veracode’s 2025 study found risky security flaws in 45% of tests across code from more than 100 LLMs, and newer, larger models did not do better. Treat AI output like code from an unknown contributor: review it, scan it and test it.¹

Key findings

• Functionality improved, security did not. Over three years, LLMs became much better at producing working code, but the security of that code generally did not improve.¹²
• More issues per change. A December 2025 CodeRabbit analysis of 470 open-source pull requests, as summarised on Wikipedia, found AI co-authored code had about 1.7 times more “major” issues than human-written code.²
• Vendors say the same. GitHub’s responsible-use notes for Copilot warn that generated code can contain vulnerabilities and should be reviewed and tested, especially for security-sensitive applications.³

Risks specific to agents

When an agent can run commands or call tools, new risks appear. The OWASP Top 10 for LLM applications (2025) lists prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03) and excessive agency (LLM06) among others.⁴

Controls that help

• Code review on every AI-authored pull request; see AI code review tools and AI code security scanners.
• Secret scanning and dependency checks in CI.
• Least-privilege tokens and sandboxes for agents.

Tools mentioned

• CodeRabbit: free plan, paid from $24/mo
• GitHub Copilot: free plan, paid from $10/mo
• Qodo: paid from $30/mo
• Greptile: free plan, paid from Free

Sources

1. Veracode: 2025 GenAI Code Security Report
2. Wikipedia: Vibe coding
3. GitHub Docs: Responsible use of Copilot inline suggestions
4. OWASP Top 10 for LLM and GenAI applications (2025)