Scholarlink

We witness an increasing usage of AI-assistants even for routine (classroom) programming tasks. However, the code generated on basis of a so called “prompt” by the programmer does not always meet accepted security standards. The actual quality of the programmers’ prompt determines whether generated code contains weaknesses or not. We analyse 4 major LLMs with respect to the security of generated Python and Javascript code using the MITRE CWE catalogue as the guiding security definition. Our results show that using different prompting techniques, some LLMs initially generate 65% code which is deemed insecure by a trained security engineer. On the other hand, LLMs generate code that is 94–100% secure with increasing manual guidance from an experienced engineer.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

You Still have to Study On the Security of LLM Generated Code

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Andreas Schaad,
  • Stefan Götz,
  • Dominik Binder

摘要

We witness an increasing usage of AI-assistants even for routine (classroom) programming tasks. However, the code generated on basis of a so called “prompt” by the programmer does not always meet accepted security standards. The actual quality of the programmers’ prompt determines whether generated code contains weaknesses or not. We analyse 4 major LLMs with respect to the security of generated Python and Javascript code using the MITRE CWE catalogue as the guiding security definition. Our results show that using different prompting techniques, some LLMs initially generate 65% code which is deemed insecure by a trained security engineer. On the other hand, LLMs generate code that is 94–100% secure with increasing manual guidance from an experienced engineer.