Veracode finds nearly 44% of AI-generated code fails security checks

On November 6, 2026, DEV Community published a piece titled "The security risks of AI-generated code and a review checklist," originally published on shipfastdev.com. It draws on Veracode testing from 2026 showing that models produce code that compiles almost 100% of the time, yet fails security checks on nearly 44% of tasks. The article notes that this pass rate has not improved since 2025. It also references Veracode's 2025 report, in which models still chose an unsafe coding approach 45% of the time when a secure one was available, with Java failing more than 70% of the time. Building on these findings, the piece lays out common failure modes and a review checklist intended for developers or outsourced teams, arguing that AI-generated code should be handled like code from an unfamiliar contractor: reviewed, scanned, and tested before it reaches production. At this point only this single article is available, and Veracode has not yet published the underlying report or offered further follow-up.