45% of AI-generated code samples introduced OWASP Top-10 vulnerabilities in Veracode’s 100+‑model study — a rate that stayed flat across the 2025→2026 testing cycles despite newer, larger models. Larger models were not measurably safer. (Veracode, 2025 GenAI Code Security Report and 2026 follow-up coverage.)
2.7× — the vulnerability-density multiple of AI-generated code versus human-written baselines in the same analysis. (Veracode.)
~40–62% — the range of insecure-program rates reported by the academic literature since 2022: Pearce et al. found ~40% of Copilot-generated programs vulnerable (rising to ~50% in C); Tihanyi et al. (2024) report over 62% of LLM-generated programs exhibit exploitable weaknesses. (arXiv 2506.11022 literature review; arXiv 2604.26482.)
434 distinct vulnerabilities catalogued in a July 2026 empirical study of applications generated by modern coding models — concentrated in denial-of-service exposure, hardcoded secrets, and authorization failures. (Reported July 22, 2026, cybersecuritynews.com.)
+107% year-over-year growth in vulnerabilities per codebase as AI-assisted volume rose. (Black Duck OSSRA 2026.)
Developers using AI assistants wrote “significantly less secure code” while exhibiting a “false sense of security” — frequently rating their insecure solutions as secure. (Perry et al., user study; via arXiv 2506.11022.)
Iterative refinement can make it worse: systematic analysis documents security degradation across successive AI regeneration rounds — asking the model to “improve” code without a specification degrades its security posture. (arXiv 2506.11022, 2026.)
Suggestion-acceptance rates of 25–40% make manual security review at pull-request volume impractical without automated gates — and without specifications, the gates have nothing precise to enforce. (Arnica CISO guidance, July 2026.)
CVE-2025-53773 (CVSS 9.6) — hidden prompt injection in pull-request descriptions enabled remote code execution through GitHub Copilot. (Cycode 2026 vulnerability roundup.)
EchoLeak — zero-click prompt injection in Microsoft 365 Copilot demonstrated silent enterprise data exfiltration. (Cycode, 2026.)
73% of AI systems assessed in 2026 security audits showed exposure to prompt injection; CrowdStrike documented injection attacks against 90+ organizations. (2026 audit reporting; CrowdStrike 2026 threat report.)
PCI DSS 4.0 and SOC 2 Type II auditors are now asking about AI-generated code provenance and pre-production security testing; organizations under HIPAA, FedRAMP, or FISMA face heightened scrutiny because undocumented AI-generated code in controlled environments can void compliance posture. (CISO guidance, July 2026.)
These numbers share one shape: the code compiles, passes review, ships — and violates a constraint nobody stated. The maintainer’s position, argued at book length: this is a specification problem, not a model problem — which is why the failure rate holds flat while models improve. The counter-position — that automated downstream gates, not upstream specification, are the practical fix — is real and well-funded; the book’s answer is that they are complements: evals and gates enforce what only a specification can define. Score your own prompt against the Frame in 60 seconds: the Specification Gap Score. Read the argument free: Delta: Closing the Specification Gap, 227 pages, no gate.
Corrections and newer published numbers: errata@acuity.press. Every entry links a public source; entries are dated and never silently edited — superseded numbers move to a dated archive section rather than disappearing.