Secure Code Warrior has released research claiming AI-generated software code contains an average of 15 confirmed vulnerabilities per codebase, including 4.3 rated “severe”, based on an assessment of 1,760 complete codebases created by 16 large language models (LLMs).
The company said the findings underpin its newly launched SCW AI Trust Index, which it describes as a “living” benchmark intended to track how frequently different AI coding models generate insecure code and what types of weaknesses recur across models and software frameworks.
The evaluation included “frontier” models from OpenAI, Anthropic, Google, Alibaba and others, according to the release. Secure Code Warrior said the methodology was developed with RMIT University and later extended by the company.
The research identified 86 distinct Common Weakness Enumerations (CWEs) across the generated codebases. Secure Code Warrior said common issues clustered around logging failures, injection vulnerabilities, insecure design and broken access control. The most prevalent weakness cited was CWE-532 (Insertion of Sensitive Information into Log Files), which the company said accounted for 8,543 “true positives”.
Secure Code Warrior argued the results show AI coding risks are “measurable” and “predictable” rather than random, and that different models exhibit consistent vulnerability patterns across frameworks—what it referred to as a distinct “security fingerprint” per model.
The company also reported that no single model performed best across all development frameworks. In examples provided, it said GPT-5.1 led in Java Enterprise API, Claude Sonnet 4.5 led in Java Spring, Claude Opus 4.8 led in Python Django, GPT-5.5 led in C# (.NET), and Claude Fable 5 led in C.
It also said the research found no consistent relationship between model cost and secure-coding performance, citing an example where GPT-5.1 achieved a high Trust Index score at “US $5.60 per run” while more expensive models performed worse.
“Every AI model we tested leaves a predictable, repeatable pattern of security gaps and weaknesses,” said Pieter Danhieux, Secure Code Warrior co-founder and chief executive officer, in a statement included in the release. “AI-generated code needs the same scrutiny we’ve always given human-written code, and now we finally have the data to know exactly where to look.”
The release frames the index as a tool for organisations to compare AI coding models using security data, identify recurring vulnerability patterns and quantify AI-generated coding risk.
