From Model to Breach: Towards Actionable LLM-Generated Vulnerabilities Reporting
This addresses the cybersecurity problem of LLM-generated code vulnerabilities for software developers and security practitioners, offering a novel metric to guide mitigation efforts.
The study found that even the latest open-weight LLMs remain vulnerable to early-reported security scenarios in realistic settings, indicating that safety-functionality trade-offs hinder effective patching. They introduced a new severity metric, Prompt Exposure (PE), and Model Exposure (ME) score to assess and prioritize LLM-generated vulnerabilities based on risk, generation chance, and prompt formulation.
As the role of Large Language Models (LLM)-based coding assistants in software development becomes more critical, so does the role of the bugs they generate in the overall cybersecurity landscape. While a number of LLM code security benchmarks have been proposed alongside approaches to improve the security of generated code, it remains unclear to what extent they have impacted widely used coding LLMs. Here, we show that even the latest open-weight models are vulnerable in the earliest reported vulnerability scenarios in a realistic use setting, suggesting that the safety-functionality trade-off has until now prevented effective patching of vulnerabilities. To help address this issue, we introduce a new severity metric that reflects the risk posed by an LLM-generated vulnerability, accounting for vulnerability severity, generation chance, and the formulation of the prompt that induces vulnerable code generation - Prompt Exposure (PE). To encourage the mitigation of the most serious and prevalent vulnerabilities, we use PE to define the Model Exposure (ME) score, which indicates the severity and prevalence of vulnerabilities a model generates.