56% Pass Rate, Two Years Flat: The AI SDLC Security Gap

Veracode's 2026 GenAI Code Security Report tested over 100 models across four measurement snapshots and found an average security pass rate of 56%, compared to 55% a year earlier. Meanwhile, AI now writes roughly half of all committed code. The failure rate held completely still while the volume beneath it doubled. That is the governance gap, and it has not moved in two years.

The Numbers Are Not the Surprise#

The 44% failure rate on security tasks is alarming in isolation. In context, it is worse. Veracode's data shows models producing syntax-correct code roughly 100% of the time. Security is the only dimension where they systematically fail, and the failure rate covers OWASP Top 10 categories, not obscure edge cases.

Coding-specialized models did not perform better than general-purpose ones: 51% versus 52%. Larger models did not outperform smaller ones: 53% for large, 51% for both medium and small. The one factor that moved the number was reasoning capability, which added about 5 percentage points. GPT-5.5 leads the current leaderboard at 68%, a step down from last year's leader at 72%. Even the best model still fails nearly one security task in three.

The Software Improvement Group's State of Software 2026 report, cited by CSO Online, adds a parallel finding: AI-generated code produces roughly twice the security risk violations of human-written code. SIG's CTO Jasper Geurts framed it directly: "AI didn't create the problem; it amplified it."

Where the Model Actually Fails#

The averages obscure the shape of the problem. Cross-site scripting and log injection are not rare vulnerability classes, and Veracode found models passing those tasks only 15% and 12% of the time respectively. SQL injection and weak cryptography fared better, at 83% and 87%. By language, Python passed 63% of security tests; Java passed just 30%.

Kay Kwak at Theori's Xint platform, working with models across 208,000 lines of code, observed a pattern worth naming: "The larger and more complex the codebase is, the more likely for AI to lose track of fine-grained user permissions." The issue is not syntax. It is that models fail to maintain coherent auth context across a system as scope grows.

1Password's Off-By-1 Labs tested patch generation across over 6,000 runs on six known vulnerabilities in complex open-source projects. Average success rate for a patch that fully resolved the vulnerability without introducing a new one: 26%. Over half of generated patches either failed to fix the original flaw, added a new vulnerability, or both.

Why Volume Changes the Calculus#

The failure rate looked manageable when AI coding was experimental. It is a different problem when 97% of organizations are already using or piloting AI coding assistants and every surveyed organization has AI-generated code in production. Georgia Tech tracked 35 CVEs in March 2026 directly attributable to AI coding tools, with researchers estimating the true count is five to ten times higher.

Amazon's internal "deep dive" in March 2026, reported by CNBC and TechRadar, described a pattern of high-severity outages with "high blast radius" linked to "Gen-AI assisted changes" for which best practices and safeguards had not yet been established. That is what the 56% pass rate looks like in production: not a clean benchmark failure, but a reliability event with production consequences and no clear owner.

As Pagerly's August 30 analysis notes, AI writes 42% of committed code and passes security tests 56% of the time. The math compounds fast.

The Layer Human Review Skips#

The practical problem for engineering teams is that intent-aware review is the exact category that gets dropped when PR volume triples. A reviewer can spot an obvious injection path. Verifying that a session invalidation covers every token type, or that a client-side role flag is not the only gate on an export route, requires reading the system as a whole, not just the diff.

SIG ran an instructive experiment: Claude Sonnet 4.6 built the same test project 20 times. Ten runs used the standard scaffold; ten added SIG's Sigrid Guardrails as a mandatory gate. The guarded runs produced approximately 97% fewer high-risk security findings and 24% higher maintainability scores. The model did not change. The enforcement layer did.

Chris Wysopal at Veracode put the conclusion plainly: "Scan it, fix it, and never ship it blind." Deterministic tools and AI-based review are complementary , each catches what the other misses. The workflow enforcing both is where the actual defense lives. The gaps are rarely in compilation. They are in cross-cutting concerns that require codebase-wide context to detect.

What Governance Actually Requires#

Three questions serve as a litmus test for whether an organization's "AI-assisted SDLC" has real security governance: Can you show a rejected PR from the last sprint? What changed about your definition of done when AI adoption started? Which metric moved as a result?

Most teams cannot answer the second or third. Clean PR histories and green scanner dashboards do not answer them either. Governance means the definition of done expanded to cover auth boundaries and privilege verification, not just functional correctness. It means a metric, not a posture.

The controls that help are not novel. Static application security testing, software composition analysis, secrets scanning, and integration tests that gate on security findings , all of these remain necessary. They need to run earlier, at generation and commit, not only post-merge. Cycode's analysis frames the shift as moving from end-state review to continuous enforcement across the full delivery pipeline.

Autonomous review that covers the entire codebase at once, across auth, reliability, and API boundaries, is precisely what fills the layer human reviewers deprioritize under volume. Hyrax runs across security, reliability, and API boundaries, submits a PR with verified fixes, and holds the merge for the engineer. The human decides. The check does not get skipped.

The 56% pass rate has held for two years. The volume of code underneath it has not.

Hyrax is live at hyrax.dev.