“The security of the autogenerated code is very much in question, as for example this article last week noted (precisely as this substack has long warned):”
Our reading, the sentence that was checked:
The security of AI-generated code is seriously in doubt.
Assessment: Supported Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, About that Matt Shumer post that has nearly 50 million views, paragraph 11.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-about-that-matt-shumer-post-that-0c22c6-a3
We recorded 4 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2026-02-11. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- The security of the autogenerated code
- is very much in question
Our interpretation
- Plain reading: as of the post (February 2026), credible evidence showed AI-generated code often contains security vulnerabilities, so its security could not be taken for granted.
- Ongoing-state claim with no named period. The target period is the half-year before the post, which covers the most recent major security studies published before it.
- This does not require that all AI code is insecure. It requires that substantial, documented security doubts existed.
Counts as supported if: Credible studies published in the period find substantial vulnerability rates in code written by LLMs or coding agents.
Counts as contradicted if: Credible studies in the period find that AI-generated code from current models is generally secure, for example with vulnerability rates comparable to or below careful human code and no serious documented concerns.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
The claim is read as saying that, as of the post on 11 February 2026, there were substantial documented doubts about the security of AI-generated code. The test period runs from 1 July 2025 to 11 February 2026. The claim is supported if credible studies from that period found substantial vulnerability rates in code written by LLMs or coding agents. On 30 July 2025, Veracode reported testing more than 100 LLMs on 80 curated coding tasks. The models introduced security vulnerabilities in 45% of cases. Veracode also said security performance had stayed unchanged over time (e1). A preprint first posted on 2 December 2025 tested coding agents on 200 real-world feature tasks. With SWE-Agent and Claude 4 Sonnet, 61% of solutions were functionally correct but only 10.5% were secure (e2). Both studies came out before the post and meet the support condition. The packet has no study from the period finding that AI-generated code was generally secure. A Veracode follow-up from 28 July 2026 reported a similar rate, but it came after the post and is context only (e3).
Limitations
- One main study comes from a security vendor with a commercial interest in highlighting risk. The other is a preprint.
- Both studies use curated or selected test tasks, not audits of deployed AI-generated code.
- 'Very much in question' is qualitative. The evidence shows substantial documented doubt, not that all AI-generated code is insecure.
- The article Marcus cites ('this article last week') was not identified.
Evidence (3 items)
Supports the claim: Veracode,
The study analyzed 80 curated coding tasks across more than 100 large language models (LLMs), revealing that while AI produces functional code, it introduces security vulnerabilities in 45 percent of cases.
Why it matters here: A large test across more than 100 LLMs found vulnerabilities in 45% of cases. That is a substantial documented security problem in AI-generated code.
- Where
- paragraph 1
- Publisher
- Veracode
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Supports the claim: arXiv (Zhao et al., Carnegie Mellon University),
Although 61% of the solutions from SWE-Agent with Claude 4 Sonnet are functionally correct, only 10.5% are secure.
Why it matters here: On real-world feature tasks, a frontier coding agent produced secure solutions only 10.5% of the time. The authors say this raises 'serious concerns' about vibe coding.
- Where
- Abstract
- Publisher
- arXiv (Zhao et al., Carnegie Mellon University)
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Supports the claim: Veracode,
roughly 44% of AI code generation tasks introduced a risky security vulnerability in tests. The average security pass rate across models is 56% – barely changed from 55% in the first report.
Why it matters here: Published after the post. It shows the concern persisted, with roughly flat security pass rates. Context only.
- Where
- paragraph 6
- Publisher
- Veracode
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, About that Matt Shumer post that has nearly 50 million views
The security of the autogenerated code is very much in question, as for example this article last week noted (precisely as this substack has long warned):
- Where
- paragraph 11
- Published
- 2026-02-11
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-about-that-matt-shumer-post-that-0c22c6-a3: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-about-that-matt-shumer-post-that-0c22c6-a3.