Security risks in AI coding tools need stronger safeguards
Security in LLM-Assisted Coding: A Systematic Literature Review
Cryptography and SecurityArtificial IntelligenceSoftware Engineering
Summary
Using large language models to write code can speed up software creation, but these models often produce insecure code or buggy fixes. The authors found that these problems come from biases in the data used to train the models and that the models themselves can be attacked. Current tests to check the security of AI-generated code are weak and sometimes unreliable. That means human experts still have to carefully check code created by these AI tools. Improving safety will need better AI designs, more security-focused tests, and ways for humans and AI to work together effectively.
What this means in practice
- •For software development teams: Identify and prevent security weak points in code produced by AI-assisted development tools during software projects.
- •For cybersecurity analysts: Develop better evaluation methods to detect vulnerabilities in AI-generated code and assess robustness of coding models against attacks.
A survey. It maps existing work.
Authors
Liang Yuan, Maryam Khanian Najafabadi, Mashud Rana, Varvara Vetrova
Abstract
Large Language Models accelerate software development but introduce severe security vulnerabilities. This systematic review investigates security risks in automated coding, benchmark limitations, and the role of human developers. Findings indicate that models frequently generate insecure code and faulty patches due to training data biases. Additionally, the models themselves are susceptible to direct attacks. Current evaluation methods suffer from data contamination and lack robust security metrics. Consequently, human oversight remains essential. Safer integration of automation will require more security-aware model architectures, stronger security-specific benchmarks, and more effective human-AI collaboration frameworks to mitigate these systemic risks.