AI Code Defect Rates: The Q3 2026 Data Report

As of Q3 2026, the rates are steady and they aren’t small. 45% of AI-generated code samples ship an OWASP Top 10 flaw. AI-assisted pull requests carry 1.7x more issues than human-only ones. Almost one in five packages an AI recommends doesn’t exist. BrassCoders, the bug scanner for AI coders, publishes this snapshot every quarter so the number you cite has a date on it.

This is the Q3 2026 edition. Every figure below comes from a named source with linked methodology, and each is labeled vendor report or peer-reviewed so you can weigh it. Five of the six are less than a year old. The next refresh lands in Q4 2026.

The Q3 2026 Rate Table

BrassCoders tracks six defect-and-security rates for Q3 2026, and the headline number is unchanged from earlier 2026 reporting: about 45% of AI-generated code samples still ship an OWASP Top 10 vulnerability. The rest of the table measures density, volume, supply chain, and the perception gap.

Here’s the full set, each with its primary source and evidence type:

Metric	Q3 2026 rate	Primary source	Type
AI code samples carrying an OWASP Top 10 flaw	45%	Veracode 2025 GenAI Code Security Report	vendor report
Issues per PR, AI-assisted vs human-only	1.7x (10.83 vs 6.45)	CodeRabbit State of AI vs Human Code Generation	vendor report
Monthly security findings, Dec 2024 to Jun 2025	10x rise	Apiiro	vendor report
Privilege-escalation paths, same window	+322%	Apiiro	vendor report
AI-recommended packages that don’t exist	19.7%	USENIX Security 2025	peer-reviewed
Developer speed with AI vs perceived speed	19% slower / felt 20% faster	METR 2025 field RCT	peer-reviewed

Each row gets its own section below, with the sample size and the caveat that rides with it.

Security Vulnerability Rate: 45% Of Samples

BrassCoders scans for the weakness classes Veracode measured, and the Q3 2026 rate holds at 45%: across more than 100 large language models tested on four languages, 45% of generated code samples introduced an OWASP Top 10 vulnerability.

The rate splits hard by language. Java fared worst at 72%. Python came in lowest at 38%, with JavaScript at 43% and C# at 45%. One weakness class stood out on its own: AI tools failed to defend against cross-site scripting in 86% of the relevant samples. The test was objective rather than a survey, each sample checked for a known vulnerability class. Source: Veracode’s 2025 GenAI Code Security Report, a vendor report from a company that sells scanning tools, so weigh it as such. It’s still the most-cited anchor for the security question, and the answer it gives is that nearly half the time, the code isn’t safe.

Defect Density: 1.7x More Issues Per PR

BrassCoders runs in the pre-merge slot where the extra issues surface, the same slot CodeRabbit measured: AI-assisted pull requests averaged 10.83 issues each against 6.45 for human-only PRs, a 1.7x multiplier across 470 open-source GitHub pull requests.

The sample split 320 AI-co-authored PRs against 150 human-only ones. The averages hide a sharper detail: high-issue outliers were far more common on the AI side, which is where a reviewer’s afternoon goes. That extra four-or-so issues per pull request is the triage load a human absorbs on every AI-assisted change. Source: CodeRabbit’s State of AI vs Human Code Generation report, another vendor figure, so read it in context. The per-PR delta is the part that transfers, and it’s what a deterministic first pass cuts before a human looks.

Security-Finding Volume: 10x In Six Months

BrassCoders matters more as commit velocity climbs, and Apiiro’s numbers show the slope: by June 2025, AI-assisted repositories were generating over 10,000 new security findings per month, a 10x rise in six months, with privilege-escalation paths up 322%.

The tradeoff is the interesting part. AI assistants cut the easy problems, syntax errors dropped 76% and logic bugs 60%, while the hard ones climbed. Privilege-escalation paths rose 322% and architectural-design flaws 153%. Developers using AI exposed sensitive cloud credentials nearly twice as often as those coding without it. Source: Apiiro’s analysis across thousands of developers and tens of thousands of repositories, a vendor report. More code shipped faster means more findings in absolute terms, and the mix shifted toward the severe end. Speed without a gate compounds.

Phantom Packages: 19.7% Don’t Exist

BrassCoders flags imports that don’t resolve before pip install runs, the defense against a defect class unique to AI: the USENIX Security 2025 package-hallucination study found 19.7% of packages recommended in LLM-generated code did not exist, rising to 21.7% on open-source models.

Commercial models did better at 5.2%, but none reached zero. Across 576,000 code samples the researchers logged 205,474 unique hallucinated package names, and the fakes weren’t random: 43% reappeared on every one of ten repeated prompts. Repetition is what makes the attack work. Register a hallucinated name, wait for an AI to recommend it, and you’ve planted malware, an attack class the researchers named slopsquatting. Source: the USENIX Security 2025 package-hallucination study, peer-reviewed. An import either resolves against the registry or it doesn’t, which makes this the cleanest deterministic check in the table.

The Perception Gap: 19% Slower, Felt 20% Faster

BrassCoders closes a gap the data keeps surfacing, that developers trust AI code more than the measurements warrant: in METR’s 2025 randomized trial, experienced open-source developers were 19% slower with AI tools while believing they were 20% faster.

They’d expected a 24% speedup going in, and kept believing in a 20% gain even after finishing slower. The trial was small and specific, a cohort of experienced developers working on mature open-source repositories they already knew well, so it doesn’t generalize to every team. It points the same direction as the security data, though: confidence in AI output runs ahead of its measured quality. Source: METR’s randomized controlled trial, a field study rather than a vendor report. A deterministic gate doesn’t argue with the confidence. It checks the code.

What BrassCoders Catches

BrassCoders catches the structural share of these defects for free and deterministically: 12 static-analysis scanners run against your AI-generated Python and JavaScript/TypeScript, emit findings as YAML, and never call out to the network on the Apache 2.0 OSS core.

Match the scanners to the table. Hardcoded secrets and weak crypto (the OWASP A02 class) go to Yelp’s detect-secrets plus seven custom format patterns. Injection sinks (A03) go to Pyre’s Pysa interprocedural taint analysis, which follows a tainted value across file boundaries the way an LLM’s context window can’t. Imports that don’t resolve, the 19.7% phantom-package class, go to a custom AI-pattern detector that checks each import before pip install runs. BrassCoders produces the same output on the same input every run.

What it doesn’t do is judge intent. BrassCoders reports the pattern match and stops; the context-aware call, whether a given match is a real bug or a false positive in this codebase, belongs to the AI assistant reading the YAML. Hand .brass/ai_instructions.yaml to Claude Code or Cursor with “address the critical issues in order,” and the model triages the deterministic findings with the context brass deliberately doesn’t infer. The free tier covers the scan. The Paid plan at $12/dev/month adds AI-powered enrichment that ranks the findings by project signature.

Why This Report Refreshes Quarterly

BrassCoders refreshes this snapshot every quarter because the denominator keeps moving: AI-assisted commit volume rises, model cohorts turn over, and a 45% rate measured against the 2024 model mix doesn’t automatically describe the 2026 one.

The rates have been sticky so far. Veracode’s 45% has held across its 2025 and 2026 reporting, and CodeRabbit’s 1.7x and USENIX’s ~20% likewise. Newer frontier models have narrowed the package-hallucination range without closing it. The per-unit rates move slowly. The volume they apply to moves fast, and Apiiro’s 10x-in-six-months finding is that volume signal. A dated report keeps the citation defensible. When you quote a number, quote its quarter. The next BrassCoders edition lands in Q4 2026, and this coverage map lives in the AI Coding Assistant Blind Spots pillar.

Run the scan against your own AI-generated code and see which rows show up:

pip install brasscoders
brasscoders --offline scan /path/to/your/project

The OSS core is free, the scan finishes in under a minute on most projects, and the YAML tells you where your codebase sits against the Q3 2026 table.