Veracode Report: AI Code Vulnerability Rate Drops to 38%, Led by Claude and GPT-6, But Complex Reasoning Remains Weak
Veracode's latest report shows a significant first-time drop in AI code vulnerability rates to 38%, with Claude Opus 5.5 and GPT-6-Sol leading at 73%. However, improvements are concentrated in pattern-recognition-heavy areas like XSS defense, while models continue to struggle with complex security reasoning requiring multi-function data flow analysis.
According to the latest "GenAI Code Security Report" by U.S. cybersecurity firm Veracode, code generated by frontier large language models has achieved its most significant security improvement since the series began. The overall security score jumped from 56% in the previous period to 62%, while the vulnerability rate dropped from 44% to 38%. This marks the first substantial progress observed by Veracode researchers in the past year.
In terms of specific model rankings, Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol tied for the top spot with a 73% pass rate, surpassing the previous high of 68% set by GPT-5.5 in July 2026. Currently, 10 models have cleared the 60% threshold, up significantly from four in the last report. Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode, stated: "Despite consistently near-perfect functionality, we have not seen a marked improvement in AI code security until now. This is the first time since running our study that we’ve been able to report a meaningful move on the security dial."
However, this progress comes with clear structural limitations. Veracode noted that the primary driver of the overall gain was improved defense against cross-site scripting (XSS), where metrics rose to 18%, representing the single biggest change in the dataset. XSS is considered the "easiest vulnerability to fix through pattern recognition," which aligns with LLM strengths. In contrast, when tasks require data-flow reasoning across multiple functions (such as in log injection cases), LLM performance continues to stall. This suggests AI is currently picking "low-hanging fruit" rather than solving deep logical security flaws.