Machine-written code has got much better at running and no better at being safe. Veracode’s Spring 2026 GenAI Code Security update puts the security pass rate for AI-generated code at roughly 55%, which is where it sat two years and several model generations ago. Correctness moved sharply over the same window while security did not, because a compiler and a test suite grade correctness for nothing and no comparable grader exists for security. Retail bought on the curve that moved. Commerce stacks that added generated integrations this year are carrying review debt, and it has settled on the code that touches payments and customer records.

The split inside that data is a measurement problem before it is a model problem. On SQL injection and weak cryptographic algorithms, Veracode’s models passed 82% to 86% of tasks, because those defects carry a local signature a checker can name without leaving the line it is reading. Detection is cheap wherever the flaw is visible in the syntax containing it. On cross-site scripting and log injection the same models scored 13% to 15%, since those defects depend on where the data travels afterwards. Automated detectors inherit that boundary exactly, which is why the scanner market has always been strongest on the classes with a shape and weakest on the classes with a context. A tool can prove a query is parameterised; it cannot decide whether the returns service should be reading a customer address, because that rule lives in a commercial policy and was never written into the repository.

Nobody has published how much of retail’s own code an agent wrote, and the absence is itself part of the exposure. The nearest available measurement is AIDev, a dataset assembled by Hao Li, Haoxiang Zhang and Ahmed E. Hassan and posted in February 2026, which catalogues 932,791 agent-authored pull requests from five commercial coding agents on public GitHub. Commerce code overwhelmingly does not sit in public repositories, so a merchant reasoning about its own exposure is extrapolating from a sample that excludes it. No dashboard in retail reports the share of the checkout an agent wrote.

The number that matters is not how often an agent writes a flaw but how often the flaw survives review. A July 2026 study by A H M Nazmus Sakib, Dipayan Banik and Murtuza Jadliwala ran 16,112 agent-authored file changes from that corpus through an LLM judge and manual analysis, and found a security code smell in 38.9% of the pull requests. A smell is not a proven exploit; it is the pattern a reviewer exists to catch. Supply-chain integrity issues were the largest category, at 82.3% of all detected smells; hardcoded credentials were a narrower slice but accounted for almost every critical-severity case.

Of the genuine leaked secrets the authors confirmed, 81.1% had cleared both automated and human review before the change was integrated. Secret scanning is the most mature detector in commercial use, tuned across a decade of human commit history, and it is the one that failed here. In a commerce repository the secret in question is a payment gateway key, a warehouse API token, or a credential on the customer database.

The same study found that human collaborators, not agents, introduced 67.6% of the confirmed leaks. That reads like exoneration; it isn’t. The failure sits in the review layer, not the authorship, and that is the costlier place to find it. Authorship can be corrected by policy; review capacity is bought one qualified person at a time.

Retail is one of the few industries where that review step is a contractual obligation, and the obligation names a person. PCI DSS v4.0.1, published by the PCI Security Standards Council, requires bespoke and custom software to be reviewed before release, and where the review is manual, requirement 6.2.3.1 requires it be performed by someone other than the code’s original author, knowledgeable in secure coding, with management approval on top. The control is purchasing independence and it defines independence by authorship. When an agent writes the change and a second agent from the same model family reads it back, the artefact survives intact and the independence does not. The scarce resource in retail integration was already the signature rather than the code; the scanner is what that signature was meant to be reading.

A merchant can pass the assessment and still have nobody who read the diff.

The strongest objection is that detection is being automated on the same curve as generation. Code-Augur, posted in June 2026 by Zhengxiong Luo, Mehtab Zafar, Dylan Wolff and Abhik Roychoudhury, opens by calling agentic vulnerability detection “a watershed moment for software security,” notes that flaws found this way had “remained masked for years,” and reports 22 new vulnerabilities in key open-source projects. If detection agents scale with writing agents, the debt is transitional and the binding constraint returns to code. For that to hold, the detector would need to know what the code was supposed to do. Code-Augur’s own design concedes the point: it works by forcing the agent to commit its tacit assumptions as in-source security assertions, then running a guided fuzzer to try to falsify them. A fuzzer can trip an assertion about a parser’s inputs; it has no way to trip an assertion about which service is entitled to read a customer’s saved address.

Commerce also has a recent demonstration of what happens after detection succeeds. CVE-2025-54236, the Adobe Commerce session-takeover flaw named SessionReaper, was discovered in August 2025 and patched and published that September. Sansec recorded 38% of Magento stores patched by 23 October, the day after mass exploitation began. Detection had done its work in that sequence and the merchant population could not absorb the result. By 26 October the firm estimated that 16% to 18% of all Magento stores carried one or more injected backdoors. Adding a faster writer to a population with that clearance rate does not start a race between generation and detection; it lengthens a queue.

The decision in front of every merchant is which half of the pipeline gets staffed. Generation capacity is purchasable by the seat and review capacity is not, which makes the cheap half look like progress and the expensive half look like friction. If generated integrations keep arriving at the present rate while the number of people qualified to read payment code stays flat, the shortfall will not announce itself as an outage. It will surface as a merchant who cannot say who read the code that touches the card number, and who learns the answer from someone else’s research blog. Syntax has an automatic grader. Security has a person, and retail has been buying as though that person came free.