Abstract:Existing works have established multiple benchmarks to highlight the security risks associated with Code GenAI. These risks are primarily reflected in two areas: a model potential to generate insecure code (insecure coding) and its utility in cyberattacks (cyberattack helpfulness). While these benchmarks have made significant strides, there remain opportunities for further improvement. For instance, many current benchmarks tend to focus more on a model ability to provide attack suggestions rather than its capacity to generate executable attacks. Additionally, most benchmarks rely heavily on static evaluation metrics, which may not be as precise as dynamic metrics such as passing test cases. Conversely, expert-verified benchmarks, while offering high-quality data, often operate at a smaller scale. To address these gaps, we develop SecCodePLT, a unified and comprehensive evaluation platform for code GenAIs' risks. For insecure code, we introduce a new methodology for data creation that combines experts with automatic generation. Our methodology ensures the data quality while enabling large-scale generation. We also associate samples with test cases to conduct code-related dynamic evaluation. For cyberattack helpfulness, we set up a real environment and construct samples to prompt a model to generate actual attacks, along with dynamic metrics in our environment. We conduct extensive experiments and show that SecCodePLT outperforms the state-of-the-art (SOTA) benchmark CyberSecEval in security relevance. Furthermore, it better identifies the security risks of SOTA models in insecure coding and cyberattack helpfulness. Finally, we apply SecCodePLT to the SOTA code agent, Cursor, and, for the first time, identify non-trivial security risks in this advanced coding agent.

AI Code Generators for Security: Friend or Foe?

AI Code Generators for Security: Friend or Foe?

Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks

Who evaluates the evaluators? On automatic metrics for assessing AI-based offensive code generators

Enhancing Robustness of AI Offensive Code Generators via Data Augmentation

Review of Generative AI Methods in Cybersecurity

DeVAIC: A Tool for Security Assessment of AI-generated Code

Poisoning Programs by Un-Repairing Code: Security Concerns of AI-generated Code

Enhancing Security of AI-Based Code Synthesis with GitHub Copilot via Cheap and Efficient Prompt-Engineering

Vulnerability Handling of AI-Generated Code -- Existing Solutions and Open Challenges

SecCodePLT: A Unified Platform for Evaluating the Security of Code GenAI

Generative AI Security: Challenges and Countermeasures

Codexity: Secure AI-assisted Code Generation

Unleashing offensive artificial intelligence: Automated attack technique code generation

The Security Risks of Generative Artificial Intelligence

Identifying and Mitigating the Security Risks of Generative AI

Generative AI for Cyber Security: Analyzing the Potential of ChatGPT, DALL-E, and Other Models for Enhancing the Security Space

Do Users Write More Insecure Code with AI Assistants?

Automating the Correctness Assessment of AI-generated Code for Security Contexts