BURLINGTON, Mass.--(BUSINESS WIRE)--Jul 28, 2026--
Veracode, the global leader in application risk management, today released its 2026 GenAI Code Security Report which reveals that, despite rapid advances in AI coding capabilities, security has stalled. Across four testing snapshots and more than 100 models tracked since the program began, the average security pass rate sits at 56 percent — virtually unchanged since last year’s report. Each model was evaluated on code-generation tasks spanning multiple programming languages and vulnerability categories, under standardized conditions with no security-specific prompting. AI now generates roughly half of all committed code, but the security gap isn’t narrowing.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260728207685/en/
The contrast is stark: models generate compilable code at a near-universal syntax pass rate of ~100 percent. When it comes to security, they fail nearly 44 percent of the time when given no security-specific guidance.
“As AI-fueled code velocity increases, developers are becoming inundated with compliance risks, security alerts, and quality issues,” said Chris Wysopal, Co-founder and Chief Security Evangelist at Veracode. “We’re seeing a rapid increase in the adoption of AI-powered tools to write code and build software. But the root problem remains: models may be almost syntactically perfect, but they are still failing on nearly half of all tasks where security is needed. That number should be a red flag for any organization.”
The GenAI Code Security Report Leaderboard: Summer 2026
OpenAI’s GPT-5.5 leads this year’s report at 68 percent, while six of the 11 models cluster between 50 percent and 53 percent. Alibaba’s Qwen3.7-max comes last at 50 percent, generating vulnerable code every other output in this test. The best model available today still fails nearly one in three security tasks. Notably, previous editions of the report were dominated by Western AI models. That's no longer the case, with Kimi-K2.6 and MiMo-V2.5 outperforming several Western models. For enterprise security teams, model provenance is one more factor worth weighing in for procurement decisions, alongside security pass rate.
Models Built for Coding and Larger LLMs Aren’t Safer
Two widely held assumptions don’t survive the data. First, models built specifically for writing software code are no more secure than general-purpose AI. Coding-specialized models averaged a 51 percent security pass rate, compared with 52 percent for general-purpose models. The tests were run against the raw models and not agents or production environments with additional tooling, guardrails, or human review in the loop. This means, developers who opt for coding-optimized tools on the assumption they’ll minimize security risk are actually shipping vulnerable code at the same rate as everyone else.
Second, model size has no impact on security performance. Large models (more than 100 billion parameters) average 53 percent, medium models average 51 percent, and small models average 51 percent. The one architectural factor that does help: reasoning models maintain a consistent security edge over non-reasoning models, at 56 percent versus 51 percent. This suggests extended reasoning functions as a form of internal code review.
Java Is Still Last — But It’s Moving in the Right Direction
Security pass rates by language range from Python at 63 percent down to Java at only 30 percent. Java remains the riskiest language for AI code generation by a significant margin. Despite sub-optimal performance, it is the only language with a clear, consistent upward trend over the past year.
“I’ve been vocal about making advanced AI models, like Claude Fable and Mythos, available to developers and defenders alike — and I stand by that position,” Wysopal closed. “The right answer is not restricting access; it’s transparent, evidence-based safety. What this research makes clear is that AI-generated code needs to be treated like any unreviewed code: scan it, fix it, and never ship it blind. Until LLMs reason about security the way they reason about syntax, guardrails in the development workflow aren’t optional.”
Managing Risk in the AI Era
Veracode recommends organizations take the following steps to address the security gap in AI-generated code:
To download the full 2026 GenAI Code Security Report, visit the Veracode website. Attendees at Black Hat in Las Vegas August 4-7 are invited to visit booth #4927 to learn more about AI code security and the report’s findings.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, Malicious Package Detection, Package Firewall, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2026 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands, or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
Fig. 3: Security Pass Rate of Models by Size
Fig. 2: Security Pass Rate of Coding-specific vs General-purpose LLMs
Fig. 1: The GenAI Code Security Report Leaderboard: Summer 2026
LEGE-CAP FERRET, France (AP) — French authorities ordered nearly 4,000 more people to evacuate Tuesday from tourist sites on the Atlantic coast as returning heat threatened firefighters’ fragile hold on a vast wildfire west of Bordeaux. The blaze in the Gironde region has burned an area four times the size of Paris and forced 220,000 people to evacuate.
Across France and Spain, roughly 330,000 people have been driven from homes and vacation sites by fires of exceptional scale. Spain braced for its fourth heat wave of the summer, with several blazes still out of control, including the largest in its recorded history.
France may never have seen an evacuation on this scale in peacetime. Interior Minister Laurent Nuñez said Saturday it was “very likely” the largest civilian evacuation operation ever carried out in the country outside of a period of war.
Firefighters held the Gironde blaze in check through a calm night, bringing flare-ups near coastal dunes under control and keeping the burned area unchanged at 420 square kilometers (162 square miles).
Authorities called the fire stabilized, not fixed — held for now, but still capable of breaking loose as temperatures rose and humidity fell.
The precautionary evacuation order covered campsites, holiday villages, tourist residences and leisure parks around the resort of Lacanau, Gironde regional authorities said.
“We are at a point of fragility,” Eric Brocardi, spokesperson for France’s national firefighters federation, told BFMTV on Tuesday. “We will continue attacking this fire despite the forecast rise in temperatures.”
Even as homes burned nearby and authorities urged tourists to stay away, some holidaymakers told French media they were still weighing whether to press ahead rather than lose thousands of euros sunk into summer rentals and train tickets.
France’s national weather service placed Gironde under a yellow heat warning from midday Tuesday, forecasting inland temperatures of 33 to 35 C (91 to 95 F). Southeast winds were expected across the department, with westerly sea breezes along the coast.
More than 1,160 square kilometers (448 square miles) have burned across France this year, according to the Interior Ministry.
Europe is the world’s fastest-warming continent, heating at more than twice the global average, according to the European Union’s Copernicus climate service. Western Europe recorded its hottest June on record, with extreme heat and widespread dryness contributing to the spread and intensification of fires in France and Spain, Copernicus said.
The Gironde blaze has raged since last week and proved wildly unpredictable, transforming at times into a self-feeding firestorm. Above it towered a gargantuan, electrified black thundercloud that generated lightning, violent winds and new fires beyond the original blaze — the first recorded in France.
In Le Porge alone, west of Bordeaux, the municipal government said about 150 homes were destroyed.
Officials warned that smoldering vegetation, rising temperatures and falling humidity could produce fresh outbreaks along the fire's vast perimeter.
Military engineers and forest-fire prevention crews resumed cutting firebreaks early Tuesday. Authorities said 103 kilometers (64 miles) had been completed.
Ninety-three firefighters have been injured, the prefecture said.
The A63 highway remained partly closed, while rail traffic south of Bordeaux was suspended except on the route toward Toulouse.
In Landes, about 15,000 evacuees — half of the total — were allowed home after a separate wildfire stopped advancing.
"The fire is fixed, which is good news in Landes,” French President Emmanuel Macron said Monday evening. Regional authorities said that meant its advance had been stopped and there were no new fire starts.
Those allowed back included residents of Sanguinet, Parentis-en-Born, Biscarrosse’s aviation village and a large campground. Several other neighborhoods remained inaccessible.
Authorities warned that the Landes fire was not extinguished. Residual hot spots, wind and drought could cause flare-ups, and surveillance and damping-down operations were expected to continue for days or possibly weeks.
Hundreds of firefighters backed by military emergency brigades and water-dropping aircraft continued battling several major wildfires in Spain.
Smoke from the fires reached Madrid itself, where residents in central and eastern districts could smell smoke and ash in recent days, emergency services said. Municipal monitors recorded increased particulate pollution in the capital.
Spanish Interior Minister Fernando Grande-Marlaska said Tuesday that nonstop work through the night left him “reasonably positive,” though officials warned that crews had only a brief window before extreme heat returned.
Spain’s national weather service said the country was bracing for its fourth heat wave of the summer, with temperatures expected to exceed 40 C (104 F) in some areas.
Authorities have evacuated about 79,000 people and ordered another 30,000 to remain in their homes. The government declared a national emergency over the fires.
The greatest concern remained two large fires that had at times come close to merging into a single blaze in wooded hills about an hour’s drive west of Madrid.
A fire in hilly, rural terrain in Ávila, west of Madrid, has become Spain’s largest on record, scorching more than 500 square kilometers (193 square miles), the government said.
Another fire in the eastern province of Castellón also forced mass evacuations.
“Look at how the valley is burned. Look at the houses, the people,” said David Gonzalez, a 48-year-old gardener who used his van to deliver supplies to firefighters in Ávila.
“We are feeling a lot of anger and helplessness. It’s something inhuman,” he said.
Fires have burned 1,530 square kilometers (590 square miles) this year in Spain, Ecology Minister Sara Aagesen said.
Spanish Prime Minister Pedro Sánchez has called for a national pact to fight wildfires, saying climate change is making them worse.
Adamson reported from Paris. Joseph Wilson in Barcelona, Spain, contributed to this report.
A control line is cut through the forest to prevent the advance of a fire in Claouey, following wildfires in the area of southwestern France, Tuesday, July 28, 2026. (AP Photo/Emma Da Silva)
Firefighters use controlled burning to halt a wildfire that continues to spread near Cebreros, Ávila province, Spain, Tuesday, July 28, 2026. (AP Photo/Manu Fernandez)
Firefighters work to suppress a fire near Lacanau, as wildfires rage outside Bordeaux, France, Monday, July 27, 2026. (AP Photo/Baz Ratner)
An Blackhawk helicopter lets a Bambi Bucket full of water go over a firezone near Lacanau, as wildfires rage outside Bordeaux, France, Monday, July 27, 2026. (AP Photo/Baz Ratner)
France's President Emmanuel Macron, center, speaks to the press next to Interior Minister Laurent Nunez, left, after a visit to the departmental fire and rescue operational center (CODIS) in Bordeaux, France, following wildfires in the area, Monday July 27, 2026. (Kenzo Tribouillard/Pool Photo via AP)
A firefighter works to suppress flames near Lacanau, as wildfires rage outside Bordeaux, France, Monday, July 27, 2026. (AP Photo/Baz Ratner)
A group hold a firehose and try to suppress a fire near Lacanau, as wildfires rage outside Bordeaux, France, Monday, July 27, 2026. (AP Photo/Baz Ratner)
