contract verification

The Security Pass Rate on AI Generated Code Has Not Moved in a Year, and Better Models Did Not Help

Veracode has now evaluated more than 150 models and the average security pass rate sits at about 56%, against 55% in their first report. Across that same period coding benchmarks improved steadily, larger models did not outperform smaller ones, and vendor claims about security aware training did not correspond to measured outcomes. A capability that stays flat while adjacent capabilities improve is telling you the bottleneck is somewhere other than the model.

Code Metal Proves Two Programs Are Equivalent. Nobody Asked What Either One Means

A $125M Series B into formal verification for defence is the strongest market proof anyone has produced that enterprises will pay real money to know whether code is correct. It also published its own ceiling, in public, and that ceiling is the reason we took a different route: equivalence is a relation between two artifacts, and it is silent about purpose.

The Diff Is the Wrong Unit of Review, and CodeRabbit Is Built on It

A pull request changes 11 lines, the tests pass, every automated reviewer approves, and three weeks later a reporting service is quietly returning wrong revenue. Nothing about the diff was incorrect. What was wrong lived in another repository nobody in the pipeline had read. This is where diff scoped review has nothing to say, and it is now the majority of what breaks in a large organisation.