AI can find zero-days but still can’t reliably write secure code

In recent months, LLMs have gone from flooding open-source projects and bug bounty programs with questionable security reports that wasted developers’ time, to routinely finding zero-day flaws that humans and traditional security audit tools had missed for years — a rapid evolution in cyber capabilities that scares even their own creators. But despite these advances in vulnerability discovery and exploit generation, AI models do not appear to be progressing as fast in vital areas of cyber defense, often leaving basic security flaws in the code they generate — a critical gap not only due to widespread use of AI for software development but also in helping provide patches for the holes AI can now readily find and exploit. According to a recent study from application security firm Veracode, 44% of AI-generated code contains at least one known OWASP Top 10 vulnerability. While recent frontier models scored higher, no model had more than a 68% security pass rate, meaning it still generated insecure code once every three tries. Moreover, the average security pass rate for AI-generated code hardly improved across four study snapshots Veracode performed over the past year, which combined tested more than 100 model versions. Meanwhile, all tested models produced syntax-correct code 99% of the time. “Why are they getting better at syntax? Why are they getting better at writing exploit code yet not getting better at writing secure code?” asks Chris Wysopal, chief security evangelist at Veracode, when discussing the results with CSO. “That is my question to [the AI labs], and that’s what we’re trying to measure.” It’s a critical question for IT leaders looking to make good on AI’s promise to accelerate software development in an era that also sees AI helping to shrink time-to-exploit closer to instantaneous. Cyber imbalance Veracode is not the only company observing the growing asymmetry between offensive and defensive cyber capabilities in LLMs. Tests from Dutch software quality assurance firm Software Improvement Group (SIG) for its State of Software 2026 report found that AI-generated code produces roughly two times the security risk violations compared to human-written code. “We also found that 71% of all code, not just AI code, has a low degree of security controls,” Jasper Geurts, SIG’s CTO, tells CSO. “AI didn’t create the problem; it amplified it. Where organizations have measured and managed code quality, AI accelerates delivery. Where they haven’t, it accelerates technical debt and security exposure.” In July, researchers from Xint.io, a code security testing platform developed by Theori, used five recent AI models from Anthropic and OpenAI to vibe-code applications from scratch, and worked with them to re-architect and harden one existing human-written application. Across the 28 app variants, the researchers found and validated 434 security flaws, of which 196 were in the newly generated codebases (greenfield) and 238 in the re-architected application (brownfield). “In general, we find that the most common type of flaws in AI-generated code are flaws where the code still compiles — so the code runs but will have embedded secrets or will use too many resources at scale,” Kay Kwak, product owner for Xint at Theori, tells CSO. “This is in part due to shortcuts/quick-starts in the training data; as well as developers asking for a feature without also explicitly asking for a guardrail. We also found that the larger and more complex the codebase is, the more likely for AI to lose track of fine-grained user permissions.” As Xint’s study shows, models have problems generating safe code even when they work on an existing codebase. And this extends to fixing security flaws, according to research from 1Password’s Off-By-1 Labs, which tested the quality of new patches generated by various models for six known and fixed vulnerabilities in complex open-source projects. Across over 6,000 runs, the average success rate for generating a patch that fully resolved the vulnerability without materially changing application behavior was just 26%. Over half of the LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both. “Since our research looked at patching, we were observing more of an editing process than a net-new creation process,” Keith Hoodlet, head of 1Password’s Off-By-1 Labs, tells CSO. “As such, our research and the research from Veracode should be viewed as complementary, rather than assessing the same challenges. Having said that, we cite their research as an inspiration for our work, and both bodies of research directionally point toward similar conclusions.” Better training alone might not solve secure coding While AI labs rush to highlight model improvements in cutting-edge vulnerability research, it’s not entirely clear why secure code generation and vulnerability remediation appear to lag far behind vulnerability discovery and exploit development. Xint’s Kwak believes that writ