Generative AI coding assistants are getting better at writing safe code, but the security gains may be largely an illusion of pattern recognition.
According to Veracode’s Fall 2026 GenAI Code Security research, the average security pass rate across tested models rose to 62%, up from 56% in the previous quarter, pushing the vulnerability rate down to around 38%. Anthropic has officially caught up with OpenAI at the top of the leaderboard, with Claude Opus 5.5 tying GPT-6 Sol for the high-water mark at 73%, Veracode said.
Yet security leaders and AppSec analysts warn that celebrating this spike misses a crucial technical detail. Speaking to TechTarget, experts said LLMs are not developing deeper architectural reasoning, but are instead getting better at pattern-matching surface-level, high-frequency bugs like cross-site scripting (XSS). This leaves complex data-flow vulnerabilities and open-source software supply chain risks completely unaddressed.
Pattern recognition vs. contextual reasoning
The jump in LLM secure coding pass rates (the share of generated code samples that came back free of the targeted vulnerabilities) was driven almost exclusively by progress in a single category: XSS, which surged to an 18% mean pass rate.
This is still a low absolute figure, but the XSS gains represented the largest movement of any category, and enough to pull the overall average upward, given that the two strongest categories (cryptography and SQL injection) were already near their ceilings.
Meanwhile, performance on harder, contextual flaws remained flat. Log injection, for instance, stagnated at around 12%.
Chris Wysopal, co-founder and chief security evangelist at Veracode, which published its secure coding report today (Oct. 29), points out that XSS gains stem from models adopting safer, modern framework defaults rather than mastering secure coding logic.
“To handle data securely, a model needs to know which inputs are user-controlled and where they go,” Wysopal said. “Log injection often requires tracing data through multiple functions to see whether it reaches a logging sink without being neutralized. The XSS gains may reflect improved recognition of familiar safe patterns; they do not, by themselves, show that models can reliably reason about security across an application.”
Naveen Chandra Gorijala, principal software engineer at VMware, cautions that these surface-level cleanups create a dangerous false sense of security for engineering teams.
“AI coding tools are great at catching basic syntax mistakes and textbook flaws, but that creates a dangerous side effect: the code looks so clean on the surface that reviewers let their guard down,” Gorijala explained. “The review fatigue hasn’t gone away; it has just moved up to the architecture level. The AI writes code with complete confidence, but it has zero understanding of the broader system context, leaving the hardest bugs for humans to dig out.
Peter Clay, vice president of forward deployed engineering at Kindo, an AI agent management platform, notes that this lack of context strips away vital information needed for risk assessment.
“Pattern-based flaws get caught earlier, but every wave, from Mythos and its ‘millions of zero-days’ to the latest PHP frenzy, shows up stripped of the only context that matters, where the flaw lives, what data it touches, and what is already standing between it and an attacker,” Clay said. “That is the exact architectural judgment the models cannot supply, so reviewers spend their day sorting a pile of findings that nobody has bothered to put in context.”
The flawed economics of premium frontier models
Even frontier models, held up as the gold standard, still fail more than one in four security tasks — a gap that raises a harder question than technical performance alone: is the premium price tag worth it?
According to Veracode, Anthropic and OpenAI’s top-tier LLM offerings lead the field with a 73% security pass rate, but reaching that performance requires premium API token spending, raising potential questions about return on investment.
Wysopal suggests that enterprises re-evaluate how they allocate their budgets between AI models and dedicated automated analysis tools, such as static application security testing (SAST).
“We don’t think most organizations have fully worked through the token economics of how to divide security work between AI and traditional analysis tools,” Wysopal said. “Their code needs downstream security checks, including SAST, because security issues can depend on how the whole program handles data, not just on the snippet the model generated.”
He added: “There may be opportunities to spend less by assigning each tool the work it handles well. For example, organizations could use established automated analysis for vulnerability classes such as SQL injection or XSS where those tools are effective, and use LLMs where they add value, such as helping with business-logic problems.”
‘Mending a small corner of a larger wound’’
Focusing strictly on AI-generated first-party code risks overlooking the largest source of enterprise risk: open-source dependencies and the software supply chain. According to Veracode’s broader research, third-party code accounts for 66% of critical security debt — unpatched, high-severity flaws that linger in production for over a year.
Bobby Kuzma, senior research manager for DevSecOps at research firm IDC, highlights that AI assistants can actively exacerbate this dependency sprawl.
“In most organizations, third-party application risks are far higher than the tip of the iceberg that represents code they, or their agents, build themselves,” Kuzma said. “Every snippet of AI-generated code can pull in a new dependency with its own pile of technical debt and latent vulnerabilities.”
Gorijala echoed this concern, noting that localized code generation feeds into broader systemic risk.
“The industry spends a lot of time obsessing over a 20-line AI-generated snippet, but from an engineering perspective, that is rarely where the real house is burning down,” Gorijala said. “The bigger problem is that to make those 20 lines work, the assistant often suggests pulling in two or three third-party packages.”
He added: “That code might look harmless, but it brings along deep trees of unpatched, transitive open-source dependencies... teams that do that while ignoring their software supply chain and dependency debt are staring at a candle while the forest catches fire.”
For Clay at Kindo, security leaders must move past the hype of auditing AI output in isolation and re-focus on holistic application exposure.
“The leaders who get this right stop asking whether code came from a model or a person and start asking where it runs, what it touches, and who can reach it, and that question almost always lands on the dependency nobody has looked at since the day it was pulled in,” he said.
James Walker is lead editor at TechTarget Cybersecurity.
