AI-written code in your company: faster, but is it safer? 2026 data

Your software house, freelancer or in-house team is almost certainly using AI to write code already. That's fine, I use it every day myself. The problem is that code that compiles and works isn't necessarily secure. I gathered the latest data on how many vulnerabilities AI introduces, whether it really speeds up work, and what to do about it as a business owner.

AI makes suggestions, but responsibility for the code is still on your side. Photo: Daniil Komov / Unsplash.

AI already writes half the code

According to the Veracode 2026 report, in companies that have adopted AI coding tools, AI authors roughly half of all committed code. It's no longer a curiosity, it's standard practice.

Developers use these tools, but they don't trust them. In the Stack Overflow survey (over 49,000 responses), 84% of developers use or plan to use AI, but 46% don't trust the accuracy of what it generates, and only 33% do. In Poland, just 26% of developers trust AI.

How many vulnerabilities does AI introduce?

Since 2025, Veracode has been testing AI models on the same tasks: the code can be written securely or with a hole, and the model chooses. In the latest measurement from October 2026:

• in 38% of tasks, AI generated code with a known security vulnerability (45% a year earlier, 44% in the summer),
• the best models reach 73% secure answers, the weakest are still at 44 to 50%,
• syntactically the code is correct almost every time, so it looks fine and passes a quick review.

It's worst exactly where websites and online stores are most exposed. Models secure code against XSS (injecting a malicious script, e.g. through a form) in only 15% of cases, and against log injection in 12%. For comparison, they handle SQL injection and cryptography correctly over 80% of the time.

An important caveat: these tests were run without any security hints in the prompt. In other words, exactly how most people write prompts: "make me a contact form".

Does AI really speed things up?

Here the data is less obvious than the marketing promises. In a randomized METR study, experienced developers worked on real tasks in their own projects. With AI it took them 19% longer on average. The most interesting part: afterwards they were convinced AI had sped them up by 20%.

To be fair, those were early-2025 tools. In its 2026 update, METR says a speedup is likely today, but it can no longer be measured reliably, because developers don't want to work without AI even for a study. The takeaway for you: don't trust claims like "with AI we do it twice as fast", look at deadlines and the number of fixes instead.

What to do as a business owner

You don't need to understand code to ask the right questions. This is how I set it up with clients:

1. Ask who reads the code before deployment. If the answer is "AI wrote it and it works", you have a problem. Every change should be reviewed by a person who understands what they're approving.
2. Require automated scanning. SAST tools and dependency scanners (e.g. Dependabot on GitHub) in the deployment process cost little and catch exactly the errors AI makes most often.
3. Write security requirements explicitly. Input validation, output escaping, permissions. A model that gets this in the prompt does noticeably better than one that has to guess.
4. Test the places where data comes in from people. Forms, login, payments, the admin panel. That's where XSS turns into a customer data leak.
5. Measure outcomes, not lines of code. Time from request to deployment, bugs after deployment, maintenance cost. More code faster isn't always better.

AI is a tool, not the person responsible for the project

I'm not telling you to give up AI. I'm telling you that someone on your side should understand what goes into production. Because when your customer database leaks, nobody will ask which model wrote the form.

If nobody in your company looks after code quality and security, read what a fractional CTO is. Or simply get in touch, and I'll review how your code deployment process looks today.

All the best,
Sławek

If you need a website that builds trust and leads to a conversation, see the website offer .