In September 2025, Veracode published a post with a number that travelled a long way: 45% of AI-generated code contained a security flaw. The mood at the time was "give it a year." Models were improving at everything else. Security would catch up.
It didn't.
Veracode's 2026 GenAI Code Security Report landed on 28 July. Across four testing snapshots and more than 100 models, the average security pass rate is 56%. Last year it was 55%. A full year of frontier releases moved the number by one point. GPT-5.5 leads the pack at 68%, and six of the eleven models tested cluster between 50% and 53%.
The syntax figure is what makes this uncomfortable. With no security prompting, models generate code that compiles almost 100% of the time, and fail security about 44% of the time. Your AI has become very, very good at writing code that looks right.
What got worse
Volume. AI now writes roughly half of all committed code, so an unchanged failure rate is bolted onto a much bigger pile.
The debt figures show it. Veracode's 2026 State of Software Security report puts 82% of organisations under security debt, up from 74% a year earlier. Critical debt, the genuinely exploitable kind, went from 50% to 60%. High risk vulnerabilities are up 36% year on year. Flaws are being created faster than anyone can close them.
What got better
The tooling, and it isn't close. Back in September 2025, "review your AI's code" mostly meant a tired human squinting at a diff. Now there's an entire layer of automation sitting in between.
Agent skills, the SKILL.md files that hand a coding agent a repeatable playbook, turned into a real ecosystem over the past year. There are security review skills, dependency audit skills, pre-deploy gates that refuse to ship until critical items pass. Claude Code ships a /security-review command. Anthropic reported in February that its Claude Code Security capability found over 500 vulnerabilities in production open source code that had survived years of expert review.
Even prompting moves the needle. Asking the model to prioritise security lifts secure output from about 56% to 66%. Ten points for one extra sentence is the best return on effort in this entire article.
The catch
The tools are attack surface now too. Snyk's ToxicSkills audit scanned 3,984 public agent skills in February 2026. Nearly 37% had at least one security flaw, 13.4% had a critical one, and 76 carried confirmed malicious payloads doing credential theft, backdoor installation and data exfiltration. Eight were still live on the registry when Snyk published.
A skill is a markdown file that executes with your agent's full privileges: filesystem, shell, network, credentials. Installing one is a trust decision, and most developers don't register that they're making it.
The part that actually worries me
Human review was meant to be the backstop under all of this. There's now evidence it's softening.
A June 2026 longitudinal study tracked 400 repeat reviewers across 11,429 reviews of AI agent pull requests. As reviewers built up experience, approval rates climbed from 27.9% to 42.4%. Change requests fell from 11.2% to 5.6%. Inline comments per review dropped 22%, and comment word count dropped 28%. Review latency went up 3.5x, which sounds like more care until you see the commenting going the other way. More time waiting in the queue, less time actually reading.
The same reviewers became less approving of human-written PRs over the same period. So it isn't general leniency. It's habituation, specific to agent code. The researchers called it rubber-stamping, and I can't think of a better word for it.
That's the real story of the last twelve months. Not that AI writes insecure code. That we're quietly getting bored of checking.
What we do about it
Four things, and none of them are exotic.
Scan everything the agent produces, the same way you'd scan a junior's first PR. Put security in the prompt every time, because ten free points is ten free points. Treat installed skills like npm packages: pin them, version them in Git, review them before they touch a repo, and don't grant broad shell access to something you found on a marketplace last Tuesday.
And rotate who reviews the agent's work. The habituation data is the strongest argument I've seen for not letting one person own that queue.
AI writing half your code is fine. Nobody reading it is the problem.
OrionX Technologies builds software and AI automation for Australian businesses. If you're shipping AI-assisted code and want a second set of eyes on how it's reviewed, get in touch.
