Secure Code Warrior has introduced the SCW AI Trust Index, a living benchmark designed to help organizations measure, compare, and govern the security risks associated with AI-generated code. Developed using a methodology created in collaboration with RMIT University and expanded by Secure Code Warrior, the index evaluates the security performance of leading large language models (LLMs) used for software development.
The research analyzed 1,760 AI-generated codebases across 16 frontier AI models from providers including OpenAI, Anthropic, Google, Alibaba, and others. The findings highlight recurring security vulnerabilities in AI-generated code, providing enterprises with data-driven insights to strengthen AI software governance and secure AI-assisted development.
As enterprises increasingly rely on AI-assisted software development, understanding the security implications of AI-generated code has become a critical priority. The SCW AI Trust Index provides organizations with an evolving benchmark that measures how different AI coding models perform from a software security perspective.
Rather than offering a one-time evaluation, the benchmark is designed as a living index that continuously expands to include new AI models, allowing security leaders to monitor changing risk profiles as AI coding technology evolves.
Secure Code Warrior's research found that AI-generated code contained an average of 15 confirmed vulnerabilities per codebase, with approximately 4.3 classified as severe.
The analysis identified 86 distinct Common Weakness Enumerations (CWEs), demonstrating that security flaws generated by AI are not random but instead follow recurring and measurable patterns. Among the most common issues was CWE-532: Insertion of Sensitive Information into Log Files, which accounted for 8,543 confirmed instances across evaluated codebases.
According to the research, recurring vulnerabilities frequently appeared in areas such as:
One of the study's key findings is that each AI coding model exhibits a distinct security fingerprint. Instead of producing random vulnerabilities, individual models consistently generate similar categories of security weaknesses across different programming frameworks.
This enables organizations to anticipate common security issues associated with specific AI coding assistants and implement appropriate governance, security reviews, and developer training programs.
"Every AI model we tested leaves a predictable, repeatable pattern of security gaps and weaknesses," said Pieter Danhieux, Secure Code Warrior Co-Founder & Chief Executive Officer. "Developers are also predictable in that they aren't going to abandon their preferred model over a security score. The SCW AI Trust Index was purpose-built to help CISOs and security leaders manage the models already in use; there is no identified "winner", but this data provides the crucial insights needed to truly manage AI tools safely, with consideration to those inherent security gaps, and allow the right guardrails and developer learning pathways to be brought to life in a modernized security program. AI-generated code needs the same scrutiny we've always given human-written code, and now we finally have the data to know exactly where to look.”
The research also concluded that no single AI model consistently generates the most secure code across every development environment.
Performance varied depending on programming languages and frameworks. For example:
The findings indicate that AI coding security depends on both the selected model and the software development framework.
Another key conclusion from the research is that higher-priced AI models do not necessarily produce more secure code.
Secure Code Warrior found no consistent relationship between API pricing and security outcomes, suggesting organizations should evaluate AI coding assistants based on measurable security performance rather than cost alone.
By combining AI governance, security visibility, and developer education, the SCW AI Trust Index is intended to help enterprises adopt AI-assisted software development while maintaining secure coding practices throughout the software development lifecycle.
Secure Code Warrior is a leader in AI software governance and developer security upskilling, enabling enterprises to control AI-driven software development across the SDLC. Built on a decade of developer security expertise, it delivers AI visibility, policy enforcement, and targeted learning to prevent vulnerabilities and strengthen software quality before production.
TechIntelPro empowers B2B technology decision-makers with the latest industry trends, deep insights, leadership perspectives and actionable intelligence to drive both organizational and professional milestones, and thrive on the tech pulse.
