Security risk framework reveals vulnerabilities in AI code tools
A Security Risk Assessment Framework for AI-Powered Development Tools
Cryptography and Security
Summary
AI tools that help write code can sometimes add security problems without people noticing. The authors created a way to measure these security risks by looking at how serious the problems are and what kind of tasks the code is doing. They tested different AI coding tools and found some tasks, like handling inputs and files, were more likely to cause risks than others. Their method helps developers check AI-generated code for security issues in a clear, repeatable way.
What this means in practice
- •For software development teams: Assess security risks in AI-assisted code generation to prioritize and fix vulnerabilities based on task type and tool used.
- •For security audit teams: Use the framework to systematically evaluate AI-generated code's security issues and improve vulnerability detection during audits.
Authors
Salem AlJanah
Abstract
AI-powered development tools are now widely used to generate code and assist developers with routine programming tasks. Although existing work has identified vulnerabilities in AI-generated code, security-oriented work is often focused on vulnerability detection rather than risk assessment. To address this gap, this paper presents a Security Risk Assessment Framework (SRF) to evaluate the security risks of AI-generated code. SRF combines threat modeling, security analysis, and a quantitative risk evaluation approach based on vulnerability criticality. The framework is applied to a set of security-relevant programming tasks, where code generated by multiple AI-powered development tools is analyzed using Bandit and Semgrep. The results show that AI-generated code can introduce security vulnerabilities across all evaluated tools. They also show that risk levels vary by task type, as input processing and file handling tasks showed higher risk, while simpler tasks remained low-risk. Differences between tools exist but are smaller than differences across task categories. Overall, SRF enables reproducible evaluation of AI-generated code and provides a practical framework for assessing its security implications.