Secure Code Warrior Research Reveals AI-Generated Code Introduces an Average of 15 Vulnerabilities Per Codebase

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development

SYDNEY & BOSTON & LONDON--(BUSINESS WIRE)--Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

Based on an evaluation of 1,760 complete codebases generated by sixteen frontier models from OpenAI, Anthropic, Google, Alibaba and others, the findings show AI-generated code carries an average of 15 confirmed vulnerabilities per codebase, 4.3 of which are considered “severe”.

As developers continue to delegate code generation to frontier LLMs, it is critical for security leaders to understand what security risks developers are inheriting, and whether those risks vary by model, by framework, or by the interaction of the two. The SCW AI Trust Index brings empirical measurement to AI-generated code security, offering a living benchmark that evolves as new models emerge, not a one-time snapshot.

Starting today, organizations can utilize the SCW AI Trust Index to understand and mitigate risk in AI-driven software development by:

• Comparing AI coding models using real-world security data
• Identifying recurring vulnerability patterns
• Quantifying AI-generated coding risk with empirical data

“Every AI model we tested leaves a predictable, repeatable pattern of security gaps and weaknesses," said Pieter Danhieux, Secure Code Warrior Co-Founder & Chief Executive Officer. "Developers are also predictable in that they aren't going to abandon their preferred model over a security score. The SCW AI Trust Index was purpose-built to help CISOs and security leaders manage the models already in use; there is no identified "winner", but this data provides the crucial insights needed to truly manage AI tools safely, with consideration to those inherent security gaps, and allow the right guardrails and developer learning pathways to be brought to life in a modernized security program. AI-generated code needs the same scrutiny we've always given human-written code, and now we finally have the data to know exactly where to look.”

Secure Code Warrior’s research reveals that AI-generated code security risk is not random, it is measurable, predictable, and concentrated in consistent patterns across AI models, frameworks, and vulnerability types. Key findings include:

• AI-generated vulnerabilities follow predictable patterns—not random failures
  • Across 1,760 AI-generated codebases, Secure Code Warrior identified 86 unique CWEs, with the most common weaknesses clustering around logging failures, injection vulnerabilities, insecure design, and broken access control. The single most prevalent CWE was CWE-532: Insertion of Sensitive Information into Log Files, with 8,543 true positives. These recurring patterns demonstrate that AI-generated security risk is measurable, repeatable, and can be anticipated.

• Every AI model has a distinct security fingerprint
  • Across all evaluated frameworks, models consistently exhibited recurring vulnerability patterns rather than random failures. The SCW AI Trust Index shows each model produces a repeatable mix of OWASP vulnerability categories, enabling organizations to anticipate where security weaknesses are most likely to occur.

• No single AI model consistently produces the most secure code
  • Model performance changes significantly depending on the framework being used. GPT-5.1 leads in Java Enterprise API, Claude Sonnet 4.5 leads in Java Spring, Claude Opus 4.8 leads in Python Django, GPT-5.5 leads in C# (.NET), and Claude Fable 5 leads in C. Security outcomes depend on both the model and the development context.

• Security outcomes are independent of model cost
  • The research found no consistent relationship between API cost and secure coding performance. For example, GPT-5.1 achieved one of the highest Trust Index scores at $5.60 per run, while significantly more expensive models produced weaker security outcomes. Organizations should evaluate AI models on measurable security performance rather than price.

The SCW AI Trust Index extends Secure Code Warrior’s mission by helping organizations understand how AI-generated code behaves, identify where risk is introduced, and enable developers to produce more secure code from the outset. By combining AI visibility, governance, and adaptive developer learning, Secure Code Warrior helps organizations confidently scale AI-assisted software development without sacrificing security.

To view the full research findings, visit: https://www.securecodewarrior.com/product/ai-trust-index

About Secure Code Warrior

Secure Code Warrior is a leader in AI software governance and developer security upskilling, enabling enterprises to control AI-driven software development across the SDLC. Built on a decade of developer security expertise, it delivers AI visibility, policy enforcement, and targeted learning to prevent vulnerabilities and strengthen software quality before production.