Veracode GenAI Code Security
Cybersecurity · 2025-07-30
Veracode's GenAI Code Security benchmark, introduced with its 2025 GenAI Code Security Report: 80 code-completion tasks, five for each pairing of four languages (Java, JavaScript, C#, Python) and four CWEs (SQL injection CWE-89, cross-site scripting CWE-80, log injection CWE-117 and broken or risky cryptography CWE-327). Each task asks the model to complete a function from a comment describing functionality that can be implemented securely or insecurely, with no security guidance, and Veracode's SAST engine checks the generated code for the targeted flaw. The security pass rate is the percentage of tasks whose code is free of it, published as a whole percent. Veracode's October 2025, Spring 2026 and Summer 2026 updates say they reuse this 80-task benchmark; the Fall 2026 snapshot, which does not restate its method, is veracode-genai-code-security-fall-2026.
Top models (higher is better)
| Model | Score |
|---|---|
| GPT-5 Mini | 72.0 |
| GPT-5 | 70.0 |
| GPT-5.5 | 68.0 |
| Gemini 2.5 Pro | 59.0 |
| Grok 4 | 55.0 |
| Sonnet 4 | 53.0 |
| Opus 4 | 50.0 |
| Sonnet 4.5 | 50.0 |
| Opus 4.1 | 49.0 |