← All benchmarks

Veracode GenAI Code Security (Fall 2026)

Cybersecurity · 2026-10-29

Veracode's Fall 2026 GenAI Code Security snapshot, published as an 18-model leaderboard on October 29, 2026: code-generation tasks in Python, C#, JavaScript and Java, given with no security-specific guidance, whose output Veracode's SAST engine checks for four CWEs (SQL injection CWE-89, broken cryptography CWE-327, cross-site scripting CWE-80 and log injection CWE-117). The score is the security pass rate, the percentage of tasks whose code has no detected vulnerability, published as a whole percent. Earlier editions state an 80-task set (veracode-genai-code-security), but this post gives no task count, run count, settings or testing window and does not say the method is unchanged, so the item count is unknown; it defers the full methodology to the 2026 report, which Veracode distributes behind a lead form.

Top models (higher is better)