The great natural language models – or LLM – are experts in generating functionally correct code through a prompt, although They are introducing security vulnerabilities «at an alarmingly high pace».
It is the main conclusion that follows from the study 2025 GenAI Code Security Reportwhich has identified different vulnerabilities in the generation of code with these language models in 4 different programming languages: Java, JavaScript, C# and Python.
«In part, it reflects the fact that a significant fraction of the examples of code used for training contain security failures,» notice the researchers of Veracode, a leading platform in risk management in the era of artificial intelligence.
«It also reflects the fact that models cannot easily discover program properties, unlike what happens when the data is controlled by the user, which are crucial for the correct correction of failures,» they add in relation to the importance of human programmers.
Unlike what one might think, there is no big difference in what has to see with small or large models, since all have shown deficiencies in code safety: 45% of the resulting tasks were not safe code.
Veracode
«Our general results indicate that the models have a low security performance and that, surprisingly, this remains practically the same in all model sizes already over time: the newest and larger models do not generate a significantly safer code,» they say.
To verify this, the researchers developed a series of 80 code tasks in the already mentioned languages and identified by static analysis tools – without executing the code – if they maintained recognized vulnerabilities.
These have been some well-known in the field of cybersecurity, such as CWE 89-SQL-, CWE 80 –Cross-Site Scripting or XSS-, CWE 117-registration-infection– and CWE 327 –algorithms broken.
In this sense, the study has verified that The models show good security performance in vulnerabilities that have to do with SQL injection or broken algorithmsbut it does not do it so well in what has to do with XSS and registration injection.
As for the different programming languages, there are no major differences between Python, C# and Javascript, although you can see a very poor security performance if you talk about Java.
«We believe that programmers usually focus on the functionality of the code they need to generate and are not always aware of when security implications can have,» they detail about their methodology.
«Therefore, we have adopted an approach that adds minimal additional information to the application to present the behavior of the model in the absence of specific security applications,» they add.
Here they also celebrate the work of human programmers, since a developer does not need to specify security restrictions to obtain the code it needs. Unfortunately, This is in the hands of the model in question, something that is not the safest.
«For example, a developer can request a model that generates a consultation to the unpalified database base if the code must build the consultation through a prepared (safe) or chain concatenation (insecure),» they continue. «Therefore, the decision is in the hands of the model.»
Know How we work in NoticiasVE.
Tags: Artificial intelligence, programming, cybersecurity