Potentially interesting sources I've found:
https://community.sap.com/t5/security-and-compliance-blog-posts/code-that-breaks-the-law-ethics-and-legal-challenges-in-ai-generated-code/ba-p/14465494
https://www.csoonline.com/article/4210735/ai-can-find-zero-days-but-still-cant-reliably-write-secure-code.html
https://www.softwareimprovementgroup.com/wp-content/uploads/State-of-Software-2026.pdf
https://www.veracode.com/resources/analyst-reports/2026-genai-code-security-report/report/