评测大模型生成代码的安全性，发现多个主流模型存在严重漏洞
The Hidden Risks of LLM-Generated Web Application Code: A Security-Centric Evaluation of Code Generation Capabilities in Large Language Models
- 用预设安全规则测试多款大模型生成的代码
- 认证、会话、输入校验等环节普遍存在安全缺陷
- 适合关注AI编程安全的研究者和开发者
大型语言模型（LLMs）的快速发展显著提升了软件开发效率，降低了编码时间和人力成本。然而，已有研究表明，在受控环境中，LLM生成的代码存在安全隐患，引发对其在真实应用中可靠性和安全性的担忧。本文采用预设安全参数，评估ChatGPT、DeepSeek、Claude、Gemini和Grok等多款模型生成代码的安全合规性。分析揭示了认证机制、会话管理、输入验证及HTTP安全头方面存在关键漏洞。尽管部分模型在有限程度上实现了安全措施，但均未完全符合行业最佳实践，凸显自动化软件开发中的潜在风险。研究强调，人类专家在确保软件安全部署或审查LLM生成代码中的关键作用，并呼吁建立强有力的安全部署框架以提升实际应用中代码的可靠性。
原文摘要 · Abstract (English)
The rapid advancement of Large Language Models (LLMs) has enhanced software development processes, minimizing the time and effort required for coding and enhancing developer productivity. However, despite their potential benefits, code generated by LLMs has been shown to generate insecure code in controlled environments, raising critical concerns about their reliability and security in real-world applications. This paper uses predefined security parameters to evaluate the security compliance of LLM-generated code across multiple models, such as ChatGPT, DeepSeek, Claude, Gemini and Grok. The analysis reveals critical vulnerabilities in authentication mechanisms, session management, input validation and HTTP security headers. Although some models implement security measures to a limited extent, none fully align with industry best practices, highlighting the associated risks in automated software development. Our findings underscore that human expertise is crucial to ensure secure software deployment or review of LLM-generated code. Also, there is a need for robust security assessment frameworks to enhance the reliability of LLM-generated code in real-world applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。