Security checks belong in every AI pipeline, not at the end.
What it is about
Veracode regularly tests how secure the code is that language models produce for typical tasks. In the 2026 report, around 44% of results contained a detectable vulnerability - practically unchanged from the previous year.
What surprised us
Models have improved at almost everything, but barely at this. More capability does not automatically mean more secure code.
What we take from it
Security checks belong inside our agent pipeline: static analysis, dependency checks and review before any change is accepted. In TISAX and ISO 27001 environments, this is not optional. More in TISAX meets GenAI.
