Security Defects in Generated Code
生成程式碼含安全缺陷
Verification & Validation
Risk Description
When a development team extensively adopts tool-generated code and merges it rapidly; due to unmitigated control gaps, after release, security scanning identifies multiple defects of the same type, all traced to unreviewed generated fragments, requiring a full retrospective review of the existing codebase, triggering compliance exposure and operational reputational costs.
Framework Mappings
NIST AI 600-1Information Security
OWASP Top 10 for LLMLLM05
NIST AI RMFMEASURE 2.7
ISO/IEC 5338驗證與確效
MIT AI Risk RepositoryDomain 7
Risk Treatment & Implementation Guidance
Subject AI-generated code to the same review as human-written code, prohibiting unreviewed merges; Integrate static security scanning into the pipeline so generated fragments must pass before commit; Tag generated code provenance so same-origin fragments can be located quickly when a vulnerability surfaces