Secure Code Warrior Research Reveals AI-Generated Code Introduces an Average of 15 Vulnerabilities Per Codebase

Secure Code Warrior , a leader in AI software governance and developer security upskilling, today introduced the SCW AI Trust Index , a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

Based on an evaluation of 1,760 complete codebases generated by sixteen frontier models from OpenAI, Anthropic, Google, Alibaba and others, the findings show AI-generated code carries an average of 15 confirmed vulnerabilities per codebase, 4.3 of which are considered “severe”.

As developers continue to delegate code generation to frontier LLMs, it is critical for security leaders to understand what security risks developers are inheriting, and whether those risks vary by model, by framework, or by the interaction of the two. The SCW AI Trust Index brings empirical measurement to AI-generated code security, offering a living benchmark that evolves as new models emerge, not a one-time snapshot.

Starting today, organizations can utilize the SCW AI Trust Index to understand and mitigate risk in AI-driven software development by:

“Every AI model we tested leaves a predictable, repeatable pattern of security gaps and weaknesses," said Pieter Danhieux, Secure Code Warrior Co-Founder & Chief Executive Officer. "Developers are also predictable in that they aren't going to abandon their preferred model over a security score. The SCW AI Trust Index was purpose-built to help CISOs and security leaders manage the models already in use; there is no identified "winner", but this data provides the crucial insights needed to truly manage AI tools safely, with consideration to those inherent security gaps, and allow the right guardrails and developer learning pathways to be brought to life in a modernized security program. AI-generated code needs the same scrutiny we've always given human-written code, and now we finally have the data to know exactly where to look.”

Secure Code Warrior’s research reveals that AI-generated code security risk is not random, it is measurable, predictable, and concentrated in consistent patterns across AI models, frameworks, and vulnerability types. Key findings include:

The SCW AI Trust Index extends Secure Code Warrior’s mission by helping organizations understand how AI-generated code behaves, identify where risk is introduced, and enable developers to produce more secure code from the outset. By combining AI visibility, governance, and adaptive developer learning, Secure Code Warrior helps organizations confidently scale AI-assisted software development without sacrificing security.

To view the full research findings, visit: https://www.securecodewarrior.com/product/ai-trust-index

About Secure Code Warrior

Secure Code Warrior is a leader in AI software governance and developer security upskilling, enabling enterprises to control AI-driven software development across the SDLC. Built on a decade of developer security expertise, it delivers AI visibility, policy enforcement, and targeted learning to prevent vulnerabilities and strengthen software quality before production.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260721153118/en/

Contact

Andrea Brusig

andrea.brusig@w2comm.com

© 2026 Business Wire, Inc.