Ai-generated code is failing security gates at a shocking rate, and java is the worst. veracode's…
ai-generated code is failing security gates at a shocking rate, and java is the worst. veracode's september audit found 45% of ai-generated samples failed security tests, with java hitting 72%.
the code writes itself now; the review just got more expensive.
Context
Veracode's 2026 GenAI Code Security blog, dated 28 July 2026, says roughly 44 percent of AI code generation tasks introduced a risky security vulnerability in tests, with an average security pass rate of 56 percent (55 percent in the first report) across more than 100 models, and that syntax is solved and security is not.
The headline is roughly 44 percent in tested generation tasks, vendor-reported, and not production samples. The September audit has no support, since the report is dated 28 July and no September Veracode audit was inspected. The note's 45 percent and the Java 72 percent were not found in the blog text; the full report page was not read, so both are unverified. The code writes itself now; the review just got more expensive is the author's take.
Watch next
- The full Veracode report's language table.
Sources
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 20 September 2026 at 23:47 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →