Large Language Models and Simple, Stupid Bugs

Jesse, Kevin; Ahmed, Toufique; Dévanbu, Prémkumar; Morgan, Emily

doi:10.1109/msr59073.2023.00082

Cited by 8 publications

(11 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our sample, four articles (Tony et al, 2022 ; Jesse et al, 2023 ; Jha and Reddy, 2023 ; Wu et al, 2023 ) analyzed code generation AI models for Java. Each research focused on very different aspects of cyber security and they did not analyze the same vulnerabilities.…”

Section: Discussionmentioning

confidence: 99%

“…Jesse et al ( 2023 ) experiments with generating single stupid bugs (SStuB) with different AI models. They provide six main findings, which can be summarized as: AI models propose twice as much SSTuB as correct code.…”

Section: Discussionmentioning

confidence: 99%

“…They provide six main findings, which can be summarized as: AI models propose twice as much SSTuB as correct code. However, they also seem to help with other SStuB (Jesse et al, 2023 ). 11 One of the issues with SStuBs is that “where Codex wrongly generates simple, stupid bugs, these may take developers significantly longer to fix than in cases where Codex does not (Jesse et al, 2023 ).” In addition, different AI models would behave differently over the SStuBs generated (Jesse et al, 2023 ).…”

Section: Discussionmentioning

confidence: 99%

“…However, they also seem to help with other SStuB (Jesse et al, 2023 ). 11 One of the issues with SStuBs is that “where Codex wrongly generates simple, stupid bugs, these may take developers significantly longer to fix than in cases where Codex does not (Jesse et al, 2023 ).” In addition, different AI models would behave differently over the SStuBs generated (Jesse et al, 2023 ). Finally, Jesse et al ( 2023 ) found that commenting on the code leads to fewer SStuBs and more patches, even if the code is misleading.…”

Section: Discussionmentioning

confidence: 99%

“…Code quality is improved by collecting more context that the user typically provides through their prompts (Pearce et al, 2022 ; Jesse et al, 2023 ). The ability to use auxiliary data, such as other project files, file names, etc.…”

Section: Discussionmentioning

confidence: 99%

See 4 more Smart Citations

A systematic literature review on the impact of AI models on the security of code generation

Negri-Ribalta,

Geraud-Stewart,

Sergeeva

et al. 2024

Front. Big Data

View full text Add to dashboard Cite

IntroductionArtificial Intelligence (AI) is increasingly used as a helper to develop computing programs. While it can boost software development and improve coding proficiency, this practice offers no guarantee of security. On the contrary, recent research shows that some AI models produce software with vulnerabilities. This situation leads to the question: How serious and widespread are the security flaws in code generated using AI models?MethodsThrough a systematic literature review, this work reviews the state of the art on how AI models impact software security. It systematizes the knowledge about the risks of using AI in coding security-critical software.ResultsIt reviews what security flaws of well-known vulnerabilities (e.g., the MITRE CWE Top 25 Most Dangerous Software Weaknesses) are commonly hidden in AI-generated code. It also reviews works that discuss how vulnerabilities in AI-generated code can be exploited to compromise security and lists the attempts to improve the security of such AI-generated code.DiscussionOverall, this work provides a comprehensive and systematic overview of the impact of AI in secure coding. This topic has sparked interest and concern within the software security engineering community. It highlights the importance of setting up security measures and processes, such as code verification, and that such practices could be customized for AI-aided code production.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%