AI Coding Tools Produce Vulnerable Code 45% of the Time, Security Rates Stagnant

·1 views

A March 2026 Veracode report tested over 150 large language models across 80 coding tasks in four programming languages, finding that 45% of AI-generated code contained known security vulnerabilities. Despite advances in model capabilities over two years, the security pass rate has remained stubbornly flat at around 55%. The weaknesses are unevenly distributed: models performed well on widely-taught flaws like SQL injection but failed badly on lesser-known issues like log injection, suggesting the problem stems from training data rather than model size. A Stanford study further found that developers using AI assistants wrote less secure code than those without, yet were more confident their code was safe — a dangerous combination that undermines human code review. Security researchers warn the risk extends beyond generated code, as AI agents also process and act on sensitive inputs like environment variables and credentials during development workflows.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Platform Engineering Is About Problem-Solving, Not Just Kubernetes Skills

A seasoned platform engineer argues that aspiring Platform Engineers should focus on understanding the problem they are solving before reaching for Kubernetes as a tool. Drawing on years of running production Kubernetes environments with hundreds of workloads, the author emphasizes three foundational questions: who the platform's customer is, how failures are handled, and how platform value is measured. The piece contends that Kubernetes abstractions — such as pods, namespaces, and network policies — are rooted in core Linux concepts like cgroups and kernel namespaces, and that skipping this foundation leaves engineers blind to where real incidents originate. The author notes that the worst production outages they encountered had root causes one layer below Kubernetes, in areas like DNS, disk I/O, or kernel limits. Ultimately, the ability to articulate how a platform reduces risk and accelerates delivery — not the number of YAML files written — is what defines a true Platform Engineer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linux from Zero #2: Understanding Processes, States, and Parent-Child Relationships

The second installment of the 'Linux from Zero' series focuses on how to interpret process information using commands like 'ps' rather than simply memorizing them. By running a test process such as 'sleep 300', readers can examine key fields including PID, PPID, STAT, and ETIME to reason about what a system is actually doing. The article explains process states — S (sleeping), R (running), D (uninterruptible I/O wait), and Z (zombie) — and notes that a process stuck in D state typically signals a disk or storage issue. It also covers the parent-child process relationship, explaining how killing a parent process affects its children and how this same logic underlies container behavior. The series uses these concepts as a foundation for upcoming topics on Linux namespaces, cgroups, and container orchestration with Kubernetes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Feature-based architecture: a cleaner way to organize frontend projects

Frontend projects often start with a type-based folder structure that works well for simple apps but becomes difficult to navigate as new features and API integrations are added. The feature-based architecture addresses this by breaking a project into self-contained modules organized around domains or entities, each managing its own components, hooks, API calls, and types. This approach improves code organization, testability, and scalability, making it easier to locate and extend specific parts of the codebase. However, deciding when a piece of logic deserves its own feature folder — rather than living inside an existing one — requires developer judgment and project maturity. The article uses a movie app as a practical example to illustrate both the benefits and the nuanced decision-making involved in adopting this structure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Metalterm: Rust and Metal-Powered macOS Terminal Weighs Under 10 MB

Developer released Metalterm, a native macOS terminal emulator built with Rust and Apple's Metal GPU framework, designed to prioritize rendering performance, low memory use, and fast startup. The app weighs approximately 9.8 MB and consumes only 0.22 ms of GPU time per frame, using just 2.6% of the available frame budget on a 120 Hz display. Unlike many modern terminals built on Electron or web stacks, Metalterm uses native macOS APIs and a custom Metal renderer, giving the developer direct control over the entire rendering pipeline. Benchmarks run by the developer show Metalterm outperforming Ghostty and Rio in app size, cold start time, idle memory, and PTY throughput under the same test conditions. The project is publicly accessible at metalterm.dev, with the developer noting benchmark results may vary depending on hardware and environment.

0 comments Read more at DEV Community