A Security Risk Assessment Framework for AI-Powered Development Tools
Researchers propose SRF, a framework showing AI-generated code from multiple development tools introduces vulnerabilities, worst in input and file handling tasks.
The paper presents the Security Risk Assessment Framework (SRF), combining threat modeling, security analysis, and quantitative risk evaluation based on vulnerability criticality for AI-generated code. Code generated by multiple AI-powered development tools was analyzed with Bandit and Semgrep across security-relevant programming tasks. All evaluated tools introduced vulnerabilities; risk varied mainly by task type, with input processing and file handling showing higher risk, while differences between tools were smaller than differences across task categories.
- SRF combines threat modeling, security analysis, and quantitative risk scoring
- Bandit and Semgrep analyzed code from multiple AI development tools
- All evaluated tools produced vulnerable code across security-relevant tasks
- Input processing and file handling tasks showed the highest risk
Full article169 words · extracted from arxiv.org · click to collapse
AI-powered development tools are now widely used to generate code and assist developers with routine programming tasks. Although existing work has identified vulnerabilities in AI-generated code, security-oriented work is often focused on vulnerability detection rather than risk assessment. To address this gap, this paper presents a Security Risk Assessment Framework (SRF) to evaluate the security risks of AI-generated code. SRF combines threat modeling, security analysis, and a quantitative risk evaluation approach based on vulnerability criticality. The framework is applied to a set of security-relevant programming tasks, where code generated by multiple AI-powered development tools is analyzed using Bandit and Semgrep. The results show that AI-generated code can introduce security vulnerabilities across all evaluated tools. They also show that risk levels vary by task type, as input processing and file handling tasks showed higher risk, while simpler tasks remained low-risk. Differences between tools exist but are smaller than differences across task categories. Overall, SRF enables reproducible evaluation of AI-generated code and provides a practical framework for assessing its security implications.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.18658