Vulnerabilidades de seguridad y patrones de programación insegura en código fuente generado por modelos de inteligencia artificial generativa
DOI:
https://doi.org/10.65415/6mgvny75Palabras clave:
inteligencia artificial generativa; seguridad del software; código fuente; vulnerabilidades; programación insegura.Resumen
La generación automática de código mediante modelos de inteligencia artificial generativa se ha integrado en editores, asistentes conversacionales y agentes de desarrollo. Su capacidad para producir soluciones funcionales no garantiza, sin embargo, que el código preserve propiedades de confidencialidad, integridad, disponibilidad y control de acceso. El objetivo de este estudio fue identificar las vulnerabilidades de seguridad y los patrones de programación insegura documentados en código fuente generado por modelos de lenguaje, así como valorar las condiciones que favorecen su propagación y las medidas de aseguramiento con respaldo empírico. Se realizó una revisión documental estructurada de estudios primarios publicados entre enero de 2022 y agosto de 2026 en fuentes académicas y técnicas reconocidas. El corpus final reunió 26 investigaciones empíricas, conjuntos de evaluación y estudios con usuarios; la síntesis se organizó mediante Common Weakness Enumeration, OWASP Top 10 y prácticas del Secure Software Development Framework. Los resultados muestran recurrencia de validación insuficiente de entradas, inyección, manejo inseguro de memoria y enteros, criptografía y credenciales débiles, uso incorrecto de APIs de seguridad, exposición de datos, configuraciones permisivas y dependencias inexistentes. También se identificaron patrones transversales: prioridad del camino feliz, reproducción del contexto vulnerable, confianza excesiva en respuestas plausibles y verificación limitada a pruebas funcionales. La evidencia no permite sostener que la IA sea siempre menos segura que el desarrollo humano, pero sí confirma que sus salidas deben tratarse como código no confiable. Se propone una estrategia de aseguramiento en profundidad que combina requisitos explícitos, análisis automatizado, pruebas adversarias, revisión humana y trazabilidad.
Descargas
Referencias
Asare, O., Nagappan, M., & Asokan, N. (2023). Is GitHub’s Copilot as bad as humans at introducing vulnerabilities in code? Empirical Software Engineering, 28(6), Article 129. https://doi.org/10.1007/s10664-023-10380-1
Bhatt, M., Chennabasappa, S., Nikolaidis, C., Wan, S., Evtimov, I., Gabi, D., Song, D., Ahmad, F., Aschermann, C., Fontana, L., Frolov, S., Giri, R. P., Kapil, D., Kozyrakis, Y., LeBlanc, D., Milazzo, J., Straumann, A., Synnaeve, G., Vontimitta, V., Whitman, S., & Saxe, J. (2023). Purple Llama CyberSecEval: A secure coding benchmark for language models. arXiv. https://doi.org/10.48550/arXiv.2312.04724
Cotroneo, D., De Luca, R., & Liguori, P. (2025). DeVAIC: A tool for security assessment of AI-generated code. Information and Software Technology, 177, 107572. https://doi.org/10.1016/j.infsof.2024.107572
Fu, Y., Liang, P., Tahir, A., Li, Z., Shahin, M., Yu, J., & Chen, J. (2025). Security weaknesses of Copilot-generated code in GitHub projects: An empirical study. ACM Transactions on Software Engineering and Methodology, 34(8), Article 218. https://doi.org/10.1145/3716848
Hajipour, H., Hassler, K., Holz, T., Schönherr, L., & Fritz, M. (2024). CodeLMSec benchmark: Systematically evaluating and finding security vulnerabilities in black-box code language models. 2024 IEEE Conference on Secure and Trustworthy Machine Learning, 684–709. https://doi.org/10.1109/SaTML59370.2024.00040
Hamer, S., d’Amorim, M., & Williams, L. (2024). Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answers. 2024 IEEE Security and Privacy Workshops, 87–94. https://doi.org/10.1109/SPW63631.2024.00014
He, J., & Vechev, M. (2023). Large language models for code: Security hardening and adversarial testing. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 1865–1879. https://doi.org/10.1145/3576915.3623175
International Organization for Standardization. (2023). ISO/IEC 25010:2023 systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model. https://www.iso.org/standard/78176.html
Khoury, R., Avila, A. R., Brunelle, J., & Camara, B. M. (2023). How secure is code generated by ChatGPT? 2023 IEEE International Conference on Systems, Man, and Cybernetics, 2445–2451. https://doi.org/10.1109/SMC53992.2023.10394237
Kitchenham, B., & Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering (EBSE Technical Report EBSE-2007-01). Keele University and Durham University.
Kudriavtseva, A., Hotak, N. A., & Gadyatskaya, O. (2025). My code is less secure with Gen AI: Surveying developers’ perceptions of the impact of code generation tools on security. Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing, 1637–1646. https://doi.org/10.1145/3672608.3707778
MITRE. (2025). 2025 CWE Top 25 most dangerous software weaknesses. https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html
Mousavi, Z., Islam, C., Moore, K., Abuadbba, A., & Babar, M. A. (2024). An investigation into misuse of Java security APIs by large language models. Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 1045–1059. https://doi.org/10.1145/3634737.3661134
National Institute of Standards and Technology. (2022). Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218
Negri-Ribalta, C., Geraud-Stewart, R., Sergeeva, A., & Lenzini, G. (2024). A systematic literature review on the impact of AI models on the security of code generation. Frontiers in Big Data, 7, 1386720. https://doi.org/10.3389/fdata.2024.1386720
OWASP Foundation. (2021). OWASP Top 10: The ten most critical web application security risks. https://owasp.org/Top10/
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., Brennan, S. E., Chou, R., Glanville, J., Grimshaw, J. M., Hróbjartsson, A., Lalu, M. M., Li, T., Loder, E. W., Mayo-Wilson, E., McDonald, S., ... Moher, D. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 372, n71. https://doi.org/10.1136/bmj.n71
Pearce, H., Ahmad, B., Tan, B., Dolan-Gavitt, B., & Karri, R. (2022). Asleep at the keyboard? Assessing the security of GitHub Copilot’s code contributions. 2022 IEEE Symposium on Security and Privacy, 754–768. https://doi.org/10.1109/SP46214.2022.9833571
Peng, J., Cui, L., Huang, K., Yang, J., & Ray, B. (2025). CWEval: Outcome-driven evaluation on functionality and security of LLM code generation. arXiv. https://doi.org/10.48550/arXiv.2501.08200
Perry, N., Srivastava, M., Kumar, D., & Boneh, D. (2023). Do users write more insecure code with AI assistants? Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2785–2799. https://doi.org/10.1145/3576915.3623157
Rabbi, M. F., Champa, A. I., Zibran, M. F., & Islam, M. R. (2024). AI writes, we analyze: The ChatGPT Python code saga. Proceedings of the 21st International Conference on Mining Software Repositories, 177–181. https://doi.org/10.1145/3643991.3645076
Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S., & Dolan-Gavitt, B. (2023). Lost at C: A user study on the security implications of large language model code assistants. 32nd USENIX Security Symposium, 2205–2222. https://www.usenix.org/conference/usenixsecurity23/presentation/sandoval
Shen, C., Dilgren, C., Chiniya, P., Griffith, L., Ding, Y., & Chen, Y. (2026). SecRepoBench: Benchmarking code agents for secure code completion in real-world repositories. Proceedings of the 3rd International Workshop on Large Language Models for Code, 159–166. https://doi.org/10.1145/3786181.3788703
Siddiq, M. L., & Santos, J. C. S. (2022). SecurityEval dataset: Mining vulnerability examples to evaluate machine learning-based code generation techniques. Proceedings of the 1st International Workshop on Mining Software Repositories Applications for Privacy and Security, 29–33. https://doi.org/10.1145/3549035.3561184
Siddiq, M. L., Santos, J. C. S., Devareddy, S., & Muller, A. (2024). SALLM: Security assessment of generated code. Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops, 54–65. https://doi.org/10.1145/3691621.3694934
Spracklen, J., Wijewickrama, R., Sakib, A. H. M. N., Maiti, A., Viswanath, B., & Jadliwala, M. (2025). We have a package for you! A comprehensive analysis of package hallucinations by code generating LLMs. 34th USENIX Security Symposium, 3687–3706. https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen
Tambon, F., Moradi Dakhel, A., Nikanjam, A., Khomh, F., Desmarais, M. C., & Antoniol, G. (2025). Bugs in large language models generated code: An empirical study. Empirical Software Engineering, 30, Article 65. https://doi.org/10.1007/s10664-025-10614-4
Tihanyi, N., Bisztray, T., Ferrag, M. A., Jain, R., & Cordeiro, L. C. (2025). How secure is AI-generated code: A large-scale comparison of large language models. Empirical Software Engineering, 30, Article 47. https://doi.org/10.1007/s10664-024-10590-1
Tihanyi, N., Bisztray, T., Jain, R., Ferrag, M. A., Cordeiro, L. C., & Mavroeidis, V. (2023). The FormAI dataset: Generative AI in software security through the lens of formal verification. Proceedings of the 19th International Conference on Predictive Models and Data Analytics in Software Engineering, 33–43. https://doi.org/10.1145/3617555.3617874
Tony, C., Díaz Ferreyra, N. E., Mutas, M., Dhif, S., & Scandariato, R. (2025). Prompting techniques for secure code generation: A systematic investigation. ACM Transactions on Software Engineering and Methodology, 34(8), 1–53. https://doi.org/10.1145/3722108
Wang, J., Luo, X., Cao, L., He, H., Huang, H., Xie, J., Jatowt, A., & Cai, Y. (2024). Is your AI-generated code really safe? Evaluating large language models on secure code generation with CodeSecEval. arXiv. https://doi.org/10.48550/arXiv.2407.02395
Wang, Y., Zhang, Z., Wang, C., Xu, X., Liu, M., Wang, Y., Chen, J., & Zheng, Z. (2026). RealSec-bench: A benchmark for evaluating secure code generation in real-world repositories. arXiv. https://doi.org/10.48550/arXiv.2601.22706
Wohlin, C. (2014). Guidelines for snowballing in systematic literature studies and a replication in software engineering. Proceedings of the 18th International Conference on Evaluation and Assessment in Software Engineering, Article 38. https://doi.org/10.1145/2601248.2601268
Yang, Y., Nie, Y., Wang, Z., Tang, Y., Guo, W., Li, B., & Song, D. (2024). SecCodePLT: A unified platform for evaluating the security of code GenAI. arXiv. https://doi.org/10.48550/arXiv.2410.11096
Descargas
Publicado
Número
Sección
Licencia
Derechos de autor 2026 Ana Arellano Arcentales, Verónica Adriana Freire Avilés, Jessica López Alvarado
Esta obra está bajo una licencia internacional Creative Commons Atribución-NoComercial-CompartirIgual 4.0.
