AI code generation: how much code AI writes in 2026 and what risks it poses for companies

AI code generation is no longer an experiment: more than 40% of pull requests on GitHub started with a first draft written by an AI agent in September 2026, up from 17% in March, according to GitHub's Octoverse 2026 report, released on October 28.

Quality is not keeping pace. 38% of AI coding tasks introduced a security vulnerability in tests by Veracode, although that figure improved from 44% in July.

40%+

Pull requests started by agents

on GitHub, September 2026

73%

Developers using assistants daily

Stack Overflow survey

38%

AI code with vulnerabilities

Veracode tests, October

Source: GitHub, Octoverse 2026 · Stack Overflow, Developer Survey 2026 · Veracode (Oct 29, 2026)

View the data as a table

Pull requests started by agents	40%+ | on GitHub, September 2026
Developers using assistants daily	73% | Stack Overflow survey
AI code with vulnerabilities	38% | Veracode tests, October

What AI code generation is

AI code generation is the use of artificial intelligence models to write, complete, fix or review code from natural-language instructions. It started as autocomplete inside the editor and now works through agents: programs that take a task, change several files and propose the change ready for review.

We compare the main tools, such as Claude Code, GitHub Copilot, Codex and Cursor, in our article on AI tools for code generation. Here we focus on how much code AI produces and what it means for companies.

How much code AI writes in 2026

Activity on GitHub soared in the 12 months to September 2026. GitHub links the rise to the use of agents, although it notes that its data does not prove cause and effect.

202410

202512.9

202634.3

Source: GitHub, Octoverse 2026 (October-to-September periods)

View the data as a table

2024	10
2025	12.9
2026	34.3

Other figures from the report:

• 1.3 billion merged pull requests in the year, about 3.5 million a day, compared with 538 million in 2025.
• 110 million agent-started pull requests in September 2026 alone, about six times March's volume.
• 90% of agent-started pull requests were merged within two weeks in September, compared with about 86% of those with no detected agent involvement.
• 55% of GitHub Copilot monthly active users use its agent features, up from 35% a year earlier.

AI involvement varies by programming language:

TypeScript44.1%

Python41.1%

Rust40.4%

Java21.2%

Source: GitHub, Octoverse 2026

View the data as a table

TypeScript	44.1%
Python	41.1%
Rust	40.4%
Java	21.2%

GitHub warns that the 40% is a floor, because it does not detect all agent use, and that it measures pull requests, not lines of code: it does not mean AI writes 40% of all code.

How secure AI-generated code is

Veracode, a software security company, regularly tests the code generated by dozens of AI models. Its results show that the code almost always works, but it is not always secure: models write syntactically correct code almost 100% of the time, yet fail at basic defenses.

Python64.2%

C#59.6%

JavaScript57%

Java31%

Source: Veracode, press release of October 29, 2026 (18 models)

View the data as a table

Python	64.2%
C#	59.6%
JavaScript	57%
Java	31%

• The average pass rate rose from 56% to 62% between July and October 2026, the first meaningful improvement since 2025, according to Veracode.
• Failures cluster around certain attacks: in July, the code withstood SQL injection 83% of the time, but cross-site scripting (XSS) only 15% of the time and log injection only 12%.
• Java remains the weakest language, with a 31% pass rate.

"The answer should never be to use the most expensive model and hope for the best," said Chris Wysopal, Veracode's co-founder, in the release. Note that Veracode sells security testing tools.

What AI code generation means for companies

For companies, AI code generation promises more speed, but it shifts the work to review: if agents write more code, someone has to check that it is correct and secure. Developers know this: 48% trust AI when they can easily validate its answers, and only 16% trust it for most tasks that do not involve important decisions, according to Stack Overflow.

In Chile, adoption is still low overall: ILIA 2026 estimates that only 13.5% of companies use artificial intelligence. We analyze this in our article on AI in business in Chile, and in investment in artificial intelligence we show that 46.5% of companies say they lack specialized talent.

Some practices that follow from the data:

1. Mandatory human review of every change proposed by an agent before it is merged.
2. Automated security tests on every change, focusing on XSS and log injection, the most frequent failures according to Veracode.
3. Small changes: agents touch several files at once (87% of their pull requests change more than one, according to GitHub), which makes them harder to review.
4. Team training in the use of these tools, one of the gaps in artificial intelligence in business across the region.

AI code generation changes month by month. InfoByData will keep tracking these indicators and update this article when GitHub, Veracode or Stack Overflow publish new data. We have no commercial relationship with any of the companies mentioned.