Research · 2026

The State of AI-Generated Code Quality (2026)

AI writes more of our software every month. Published research shows how much of it ships insecure, buggy, and hard to maintain — and what that means for teams betting on AI-built products.

Compiled by SynchSoft · August 2026 · every figure links its primary source

Key findings

45%1

of AI-generated code samples introduced a security vulnerability from the OWASP Top 10 (Veracode, 2025).

≈ Half2

of AI-generated code snippets tested contained bugs — often impactful and potentially exploitable (Georgetown CSET, 2024).

10.5%3

of code from the best agent tested was secure — even though 61% of it was functionally correct (SusVibes benchmark, 2025).

3.1%4

of developers say they “highly trust” the accuracy of AI-tool output — while 84% use those tools (Stack Overflow, 2025).

Security: it works before it’s safe

The clearest signal across independent studies is a gap between code that runs and code that’s secure. AI reliably produces the former; the latter takes deliberate work these tools don’t do on their own.

  • Veracode’s 2025 GenAI Code Security Report found that 45% of AI-generated code samples introduced a vulnerability from the OWASP Top 10.1

  • In the same tests, AI tools failed to defend against cross-site scripting (CWE-80) in 86% of relevant samples.1

  • Security-failure rates varied sharply by language: Java was riskiest at 72%, versus 45% for C#, 43% for JavaScript, and 38% for Python.1

  • Georgetown’s Center for Security and Emerging Technology tested five large language models and found that nearly half of the code snippets they generated contained bugs — often impactful and potentially exploitable.2

  • A 2025 benchmark of agent-generated code on 200 real-world tasks (SusVibes) found the best-performing agent produced functionally correct code 61% of the time, but secure code only 10.5% of the time.3

Adoption is near-universal — trust is not

AI coding tools are now standard equipment. What’s striking is how little the developers using them trust what comes out.

  • 84% of developers report using or planning to use AI tools in their development process.4

  • Yet only 3.1% say they “highly trust” the accuracy of that output.4

  • More developers actively distrust AI accuracy (45.7%) than trust it (32.7%).4

  • The shift is now cultural, not just technical: “vibe coding” was named Collins Dictionary’s Word of the Year for 2025.5

Individual speed, team instability

AI clearly makes individual developers faster. The research on what happens at the team and system level is more sobering.

  • Google’s DORA 2024 research found that AI adoption improves individual productivity, but is associated with reduced software-delivery stability and throughput at the team level.6

Not abstract: named, public failures

The gap between “passes the demo” and “safe in production” played out publicly through 2025.

  • Lovable, an AI app-builder, carried a critical access-control flaw (CVE-2025-48757, scored CVSS 9.3 by the assigning authority): a weak row-level-security policy let unauthenticated attackers read and write arbitrary database tables of generated sites. The vendor disputed the record.7

  • A security scan by Escape.tech of roughly 1,400 publicly accessible vibe-coded apps found 2,038 highly critical vulnerabilities, more than 400 leaked secrets, and 175 instances of exposed personal data — including bank-account information.8

  • A Replit AI agent deleted a live production database during an explicit code freeze, then misreported what it had done — an incident documented by entrepreneur Jason Lemkin and widely reported.9

How we compiled this

We collected published research, vendor security studies, and documented incidents on the quality and security of AI-generated code, and included only figures we could verify against their primary source — the study, report, or record itself, not a secondhand summary. Each figure above links to that source below. Where a widely-repeated number couldn't be traced to a primary source, we left it out. If you spot an error or a better source, tell us and we'll correct it.

This is why we built AI-First rescue.

The speed of AI codegen is real — and so is the debt it leaves behind. We're the senior team that turns AI-generated and vibe-coded apps into secure, scalable, production-grade software. Start with a self-check or a senior audit.

Take the Risk Scorecard How rescue works

References

  1. 1.Veracode — 2025 GenAI Code Security Report (2025). veracode.com/blog/genai-code-security-report
  2. 2.Georgetown CSET — Cybersecurity Risks of AI-Generated Code (2024). cset.georgetown.edu/publication/cybersecurity-risks-of-ai-generated-code
  3. 3.Zhao et al. (SusVibes benchmark) — Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks (2025). arxiv.org/abs/2512.03262
  4. 4.Stack Overflow — 2025 Developer Survey — AI (2025). survey.stackoverflow.co/2025/ai
  5. 5.Collins Dictionary — Word of the Year 2025 (2025). blog.collinsdictionary.com/language-lovers/collins-word-of-the-year-2025-ai-meets-authenticity-as-society-shifts
  6. 6.Google Cloud DORA — Accelerate State of DevOps Report 2024 (2024). dora.dev/research/2024/dora-report
  7. 7.NIST National Vulnerability Database — CVE-2025-48757 (Lovable) (2025). nvd.nist.gov/vuln/detail/CVE-2025-48757
  8. 8.Escape.tech — The State of Security of Vibe Coded Apps (2025). escape.tech/state-of-security-of-vibe-coded-apps
  9. 9.The Register — Replit AI agent deletes production database (SaaStr incident) (2025). theregister.com/2025/07/21/replit_saastr_vibe_coding_incident