Veracode’s AI code benchmark shows uneven security results

Veracode reported on October 29, 2026, that Claude Opus 5.5 and GPT-6-Sol each passed 73% of security checks in its October benchmark; both scored 100% on syntax. Those results came from a test of generated-code tasks, not a measurement of security across deployed software. Veracode’s benchmark covered 18 models, four programming languages and four categories of software weakness.

Veracode’s reported average security pass rate rose from 56% in its July snapshot to 62% in October, a six-percentage-point increase. The company said it evaluated generated code without security-specific guidance.

What the benchmark measured

Veracode assessed generated code in Python, C#, JavaScript and Java against four categories identified by the Common Weakness Enumeration (CWE), a system for classifying software weaknesses: SQL injection (CWE-89), cryptographic weaknesses (CWE-327), cross-site scripting (CWE-80) and log injection (CWE-117).

The security pass rate and syntax score measure different things. Syntax measures whether the output parses. The security score reflects whether generated code passed the benchmark’s checks for its selected weakness categories. A perfect syntax score, on its own, does not mean the code passed those security checks.

How the 18 models scored

Veracode’s leaderboard placed Claude Opus 5.5 and GPT-6-Sol at the top, tied on security pass rate. The remaining models had security scores from 72% to 44%; their syntax scores were usually higher than their security scores.

Security results varied by language and weakness

Python had the highest reported language-level pass rate and Java the lowest. Veracode’s results were:

The category results also show that the overall increase was uneven. Veracode reported the following July-to-October changes; the October CWE-80 figure is a mean.

Veracode attributed much of the improvement to cross-site scripting, which it described as more recognizable through familiar coding patterns. Log injection, which can require tracing how data moves through code, changed little in the reported results. That explanation is the company’s interpretation of the benchmark, while the percentages describe the measured category results.

What the scores mean for code review

A 73% pass rate means a model passed 73% of the security checks in this benchmark. It does not give the percentage of production software that is secure. The results also do not establish what different prompts, iterative agent workflows or production repositories would score.

Veracode recommends combining generated code with security testing and remediation, and said its benchmark used no security-specific guidance in the prompts. For development teams, the practical point is to keep syntax checks separate from security review: code that parses can still fail checks for specific weaknesses. Veracode’s announcement describes that testing condition and recommendation.