LLM Code Injection: How AI Assistants Introduce Subtle Vulnerabilities
Research into vulnerability classes LLMs systematically introduce and detection strategies for LLM code injection.
LLM Code Injection: How AI Assistants Introduce Subtle Vulnerabilities
Large language models are trained on public code, including security flaws. When you ask an LLM to generate code, it reproduces patterns from its training data—including vulnerabilities from Stack Overflow, deprecated libraries, and insecure examples.
This is "LLM code injection": not malicious injection by an attacker, but the systematic replication of insecure patterns by an AI assistant.
The Vulnerability Classes LLMs Introduce
1. SQL Injection in ORM Code
Developers ask for queries; LLMs reproduce vulnerable patterns from training data. ORM frameworks prevent this, but LLMs generate it anyway.
2. Weak Cryptography Defaults
Asking for password hashing might yield MD5—broken since 2004 but still in millions of LLM training examples.
3. Insecure Deserialization
Pickle, YAML, and eval() patterns appear in LLM output despite documented unsafe risks.
4. Missing CSRF Tokens
LLMs know about CSRF but don't always apply it unless explicitly prompted, leaving web forms exposed.
Why LLMs Introduce These Bugs
1. Training data favors quantity over correctness — Millions of Stack Overflow examples include bad advice
2. LLMs predict, not verify — They output likely token sequences, not secure patterns
3. Context windows are limited — Can't hold your entire codebase's security posture
4. Edge cases go unpredicted — Unusual but critical patterns absent from training
Detection Strategies
Static Analysis (Bandit, Snyk, Checkov) catches 70% of LLM bugs. Behavioral testing catches the rest through unit tests focused on exception handling, null pointer risks, and resource cleanup.
Code Review Checklist for LLM-Generated Functions
- Does it use deprecated libraries?
- Does it handle exceptions?
- Does it validate input?
- Does it use the latest secure framework defaults?
Teams shipping AI-generated code at scale are learning this lesson: static analysis, behavioral testing, and human review cost less than recovering from a breach.