AI-written code and the security gap scanners miss

AI-written code fails in quiet ways. It looks idiomatic, it compiles, it often passes the tests, and it reads well enough to get through a busy code review. The problems are in what it does not do: validate input properly, handle secrets safely, check permissions, or choose dependencies deliberately.

What the research shows

Veracode tested code generated by more than 100 large language models across 80 coding tasks designed to expose common weaknesses. The results are hard to ignore.

• All tasks, all models45%
• Java70%
• Cross-site scripting defenses86%

Source: Veracode GenAI Code Security Report, July 2025. Java figure reported as above 70%

At the same time, the code base around those flaws is growing faster and getting less tidy.

More code, more duplication, and code that is almost right: that combination is exactly where security problems hide.

Why generic scanners are not enough

Static analysis and dependency scanners are useful, and every team should run them. But they have three limits that matter more with AI-written code.

• Noise. Scanners report hundreds of findings with little sense of which matter in your system. Teams either drown in them or start ignoring them.
• Context. Many real risks depend on how code is used: which data flows through it, who can call it, what it trusts. A pattern that is safe in one place is dangerous in another.
• Logic. Missing authorization checks, unsafe defaults and broken business rules often look like perfectly valid code to a tool.

A better approach: security inside the loop

The answer is not to slow everything down with a large security review at the end. It is to move checks into the delivery loop, rank findings by real risk, and keep independent verification for what matters most.

1. 1Guide the toolsGive AI tools your security patterns, approved libraries and context, so they generate safer code to begin with.
2. 2Check as you writeRun focused checks in every loop, not in a phase at the end.
3. 3Rank by real riskTriage findings by impact in your system, not by scanner severity alone.
4. 4Verify independentlyUse an independent, in-depth audit before major releases and for critical systems.

In our own audits we use a set of more than twenty engineering checks, built from decades of seeing where software fails in production. They cover code and security, but also architecture, tests, performance and operations, because many security incidents start as quality problems somewhere else.

Independence matters

One principle we hold firmly: the people who built the software should not be the only ones who verify it. We never independently audit software we built for the same client. Independence is what makes an audit’s conclusions credible to boards, customers and regulators.

The bottom line

AI makes producing code effortless, including insecure code. Security has to keep pace: guided tools, checks inside every loop, findings ranked by real risk, and independent verification where the stakes are highest. Scanners help. Judgment decides.