State of the Art of the Security of Code Generated by LLMs: A Systematic Literature Review

AI -assisted programming has experienced a surge in popularity over the past few years, largely thanks to advancements in Large Language Model technologies. This has led to the emergence of tools like ChatGPT and GitHub Copilot. However, the use of AI models for code generation comes with a downside: the resulting code is susceptible to vulnerabilities, thus posing new challenges in the field of secure software development. In this study, we analyze the current state of research regarding the security of LLM generated code from the Software Engineering perspective. We conducted a Systematic Literature Review following the guidelines from Kitchenham et al. The search process included five sources: IEEE Xplore, ACM, Science Direct, Springer Link and Wiley Online Library. We also included an iteration of backward and forward snowballing. We obtained 3104 peer-reviewed studies though Quasi-Gold aided automated search and selected the most relevant ones through 5 stages. The final selection includes 15 primary studies from which we extracted and synthesized data. We identified seven different kinds of security vulnerability present in LLM generated code, six different mitigation strategies and practices, and four tools recommended by authors to use in conjunction with LLM code generation. Security related issues within LLM generated code have only just begun to be explored, initial research has already emphasized the significance of considering the inclusion of AI-powered code generation in software projects, as it carries the risk of introducing vulnerabilities at a higher rate than human-generated code. The vulnerabilities, practices and tools identified in this study, can potentially help developers to use LLM programming assistants more responsibly, making informed decisions when leveraging LLM technology.