The short answer. Four independent studies published between 2025 and 2026 converge on the same finding: AI-generated code carries roughly 1.7 to 2 times the defect density of human-written code. CodeRabbit found 10.83 issues per AI pull request against 6.45 for human ones across 470 real open-source PRs. The Software Improvement Group found about double the security-risk violations across 30,000 enterprise systems. Six frontier coding agents passed 73.6% to 91.3% of functional tests but only 16.4% to 25.1% of functional-and-secure tests.
This page collects the numbers, names the methodology, and separates what is measured from what is inferred. Where a study has a limitation that changes how its headline number should be read, the limitation is stated next to the number rather than buried at the bottom.
Defect density: AI code versus human code
| Study | Sample | Finding |
|---|---|---|
| CodeRabbit, 2025 | 470 real open-source pull requests | AI PRs averaged 10.83 issues, human PRs 6.45. About 1.7x. Logic and correctness errors up 75% in machine-generated code. |
| Software Improvement Group, 2026 | 30,000 enterprise systems | Machine-generated code had roughly 2x the security-risk violations. More than half of machine-generated codebases contained vulnerabilities. 86% of benchmark code fell below recommended maintainability; 71% scored low on security controls. |
| IOActive, May 2026 | Machine-generated code samples | Nearly one third were fully exploitable. No model produced 100% secure code. Even the best configuration still produced 90 vulnerabilities. |
| DORA, 2025 special report | Industry-wide delivery metrics | Bug rates up 9%, average pull request size up 154%, code review time up 91%. |
| Linux Foundation and OpenSSF, 2026 CRA report | CVE submissions, software development industry | CVE submissions up 394% in Q1 2026. High-severity vulnerabilities up 811%. |
Read the CVE figure carefully. It counts disclosed vulnerabilities in software products, not vulnerabilities in AI-generated code specifically. It establishes that the industry's disclosed vulnerability volume rose sharply in the same period AI coding tools spread. It does not, on its own, attribute the rise to AI. The CodeRabbit and SIG studies are the ones that isolate authorship, and both point the same direction.
Functional versus secure: the three-to-one gap
The most useful single number in this literature is the gap between whether code runs and whether it is safe. Across six frontier coding agents, evaluated on the same tasks:
| Measure | Range across agents |
|---|---|
| Functional tests passed | 73.6% to 91.3% |
| Functional and secure tests passed | 16.4% to 25.1% |
The gap was roughly three to one for every agent tested, not just for the weakest one. That consistency matters: it means the security deficit is a property of how these systems are trained and evaluated, not a quality difference between vendors.
What AI code review tools actually catch
GitHub published ReviewBench in October 2026: 219 real pull requests from 187 public repositories across 19 programming languages. The top entry, Copilot Code Review in its balanced configuration, posted 87.8% grounded precision and 26.0% grounded recall.
| Tool | Measure | Result | Source |
|---|---|---|---|
| Copilot Code Review | Grounded precision / recall | 87.8% / 26.0% | GitHub ReviewBench, Oct 2026 |
| Greptile | Bug detection, 309 PRs | 82% | Independent benchmark, 2026 |
| Copilot | Bug detection, 309 PRs | 54% | Same |
| CodeRabbit | Bug detection, 309 PRs | 44% | Same |
High precision with low recall means the tool is usually right about what it flags, and misses most of what it does not. A reviewer who trusts the tool to be complete will approve code that was never actually checked.
ReviewBench also carries a methodological caveat worth knowing: nearly half of the benchmark's true-positive answer key comes from Copilot Code Review itself. A tool being scored against a key it partly generated is a self-inclusion problem. The 87.8% precision figure should be read with that in mind, and the independent 309-PR benchmark, which put Copilot at 54% detection rather than near-ceiling, is the better sanity check.
How far the adoption has gone
In June 2026, Anthropic disclosed that more than 80% of the code merged into its production codebase was authored by Claude as of May 2026, up from low single digits when Claude Code launched in February 2025.
That is the strongest available signal about where the industry is heading, and it sits next to the defect data rather than in conflict with it. A codebase that is 80% machine-authored and carries 1.7 times the defect density of the alternative is not a codebase with a tooling problem. It is a codebase whose review function has to be rebuilt at a different scale.
The China difference: review as a gate, not a product
Chinese enterprises largely treat AI code review as a CI/CD gate rather than a purchasable product. CAICT, the China Academy of Information and Communications Technology, runs Fangsheng-Code 2.0 as a public national benchmark for AI on real software work, alongside a 100-test certification for code review tooling. The American equivalent benchmark is classified and aimed at cyber risk.
The practical consequence is architectural. When review is a merge gate, it cannot be skipped by the team that is in a hurry, and its recall becomes a build-breaking metric rather than a dashboard number. When review is a product, adoption is voluntary and recall competes against noise tolerance.
What the data says to do
The evidence points away from buying another detector and toward capacity and gating. Three findings support that:
One. Detection is already precise and imprecise in opposite directions. Precision near 88% with recall near 26% means the marginal detector adds little; the binding constraint is how much review capacity exists per unit of code shipped.
Two. Pull request size expanded 154% while review time rose 91%. Review time grew less than PR size, which means effective review depth per line fell. Smaller PRs are the only lever in that data that moves the ratio back.
Three. Functional tests passing at 91% while security tests pass at 25% means the test suite is measuring the wrong thing for the risk that actually exists. A separate security gate is not redundant with the functional suite; it is measuring a different property that the functional suite does not touch.
Frequently asked questions
Does AI-generated code have more bugs than human code?
Yes, by measurable margins. CodeRabbit found 10.83 issues per AI pull request against 6.45 for human ones across 470 real PRs. SIG found about double the security-risk violations across 30,000 enterprise systems.
How much AI-generated code is secure?
About a quarter, depending on the model. Functional-and-secure pass rates ranged from 16.4% to 25.1% across six frontier coding agents, against functional pass rates of 73.6% to 91.3%.
What precision and recall should I expect from AI code review?
GitHub's ReviewBench put its top entry at 87.8% precision and 26.0% recall. Independent testing on 309 PRs put Copilot at 54% bug detection, CodeRabbit at 44%, and Greptile at 82%.
Did AI assistance increase bug rates industry-wide?
DORA's 2025 special report found bug rates up 9%, PR size up 154%, and review time up 91% after AI-assisted programming became widespread.
How do you improve AI-generated code quality?
Smaller pull requests, a mandatory security gate separate from the functional suite, and review capacity scaled to code volume. The data does not support buying additional detection tools as the primary fix, because detection precision is already high while recall is low.
How much of Anthropic's code is AI-written?
More than 80% of merged code in its production codebase as of May 2026, per its June 2026 disclosure.
Sources
- CodeRabbit, analysis of 470 open-source pull requests, 2025.
- Software Improvement Group, analysis of 30,000 enterprise systems, 2026.
- IOActive, machine-generated code security analysis, May 2026.
- DORA, 2025 special report on AI-assisted software delivery.
- Linux Foundation and OpenSSF, 2026 CRA report: CVE submission data for Q1 2026.
- GitHub, ReviewBench, October 2026: 219 pull requests, 187 repositories, 19 languages.
- Independent review-tool benchmark across 309 pull requests, 2026.
- Anthropic, production codebase disclosure, June 2026.
- CAICT, Fangsheng-Code 2.0 national benchmark and code review certification.
Update log. First published November 8, 2026. Figures will be revised when the underlying studies are updated or superseded.
The information provided on this page is for general informational and educational purposes only. It does not constitute legal, financial, or professional advice. The author and publisher are not responsible for any actions taken based on the content of this page. Readers should consult qualified professionals for advice specific to their situation. All trademarks and references to third-party products, services, or organizations are the property of their respective owners. Benchmark results reflect the specific configurations tested and may not generalize.
Limitations: study samples differ in size and methodology, so cross-study comparisons are directional rather than exact; the CVE figure counts industry-wide disclosures, not AI-authored code specifically; benchmark results depend on the answer key used, and one major benchmark has a self-inclusion caveat noted above.