Security
AI-generated code: 45% contains known flaws
Veracode's 2026 report and a METR study are reminders that speed is not enough without a change in method.
According to Veracode's State of Software Security 2026 report, 45% of AI-generated code contains known vulnerabilities.
A randomised controlled trial run by METR in 2025 measured a 19% slowdown for experienced developers using AI without changing how they work.
Key takeaways
- Reviewing and testing generated code remains essential.
- Gains come from how work is organised, not just from the tool.
- Automated review and traceability are the next priorities.
Sources: Veracode 2026; METR, 2025.