We still don't trust code agents completely (good!), but we know that

Job description

We still don't trust code agents completely (good!), but we know that every diff gets bigger. And we can't review everything. So what do we do? Scan. Yes, sometimes with models. That doesn't help with trust. But, let's say we do trust them. the question is - do they find the problems. According to Veracode's research, the answer is yes. But for syntactical stuff. 95% syntax correctness. Which is not really surprising, because most of the code out there runs. And that's what models have been trained on. But get this: just 55% of the code passes security. 45% doesn't. Almost half. And not a single run or model. On 150+ models and over two years. The security grading stayed flat. You say "models will get better"? Well, they did over two years. The results didn't change. So, maybe models will get better in five years. By then, how much AI generated code will be already in place with so many holes in it?