A Security Risk Assessment Framework for AI-Powered Development Tools
Researchers propose SRF, a framework showing AI-generated code from multiple development tools introduces vulnerabilities, worst in input and file handling tasks.
The paper presents the Security Risk Assessment Framework (SRF), combining threat modeling, security analysis, and quantitative risk evaluation based on vulnerability criticality for AI-generated code. Code generated by multiple AI-powered development tools was analyzed with Bandit and Semgrep across security-relevant programming tasks. All evaluated tools introduced vulnerabilities; risk varied mainly by task type, with input processing and file handling showing higher risk, while differences between tools were smaller than differences across task categories.
- SRF combines threat modeling, security analysis, and quantitative risk scoring
- Bandit and Semgrep analyzed code from multiple AI development tools
- All evaluated tools produced vulnerable code across security-relevant tasks
- Input processing and file handling tasks showed the highest risk
From the original article
1 min read at arxiv.orgAI-powered development tools are now widely used to generate code and assist developers with routine programming tasks. Although existing work has identified vulnerabilities in AI-generated code, security-oriented work is often focused on vulnerability detection rather than risk assessment.
By Salem AlJanah · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.