You will hear a number for this. Know what it measures before you repeat it.
How often AI code is insecure
Also called Veracode GenAI report
Studies ask models to write code for risky tasks and scan the result. Numbers near half failing get quoted widely. They come from particular tests with particular limits, so they're a warning that this happens, not a rate for your codebase.
If you quote the headline as a fact, a sceptical listener will take it apart. The defensible claim is smaller and more useful: models often write insecure code when nobody asks them for secure code, and passing tests won't tell you.
“Render comments as Markdown. The threats are script tags, event handler attributes and javascript: links, including ones hidden by control characters. Allow only https: and mailto: links, escape everything else, and add a test for each threat.”