2026-07-26T03:03:02Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:24039 2025-12-12T14:58:36Z ddc:004 open_access

Are We There Yet? On Security Vulnerabilities Produced by Open Source Generative AI Models and Its Implications for Security Education Santos Galeano, Maria Camila Espinha Gasiba, Tiago Amburi, Sathwik Pinto-Albuquerque, Maria Generative AI Code Security Programming Education Prompt Engineering Secure Coding Static Analysis With the increasing integration of large language models (LLMs) into software development and programming education, concerns have emerged about the security of AI-generated code. This study investigates the security of three open source code generation models. Codestral, DeepSeek R1, and LLaMA 3.3 70B using structured prompts in Python, C, and Java. Some prompts were designed to explicitly trigger known vulnerability patterns, such as unsanitized input handling or unsafe memory operations, in order to assess how each model responds to security-sensitive tasks. The findings reveal recurring issues, including command execution vulnerabilities, insecure memory handling, and insufficient input validation. In response, we propose a set of recommendations for integrating secure prompt design and code auditing practices into developer training. These guidelines aim to help future developers generate safer code and better identify flaws in GenAI-generated output. This work offers an initial analysis of the limitations of GenAI-assisted code generation and provides actionable strategies to support the more secure and responsible use of these tools in professional and educational contexts. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Maria Camila Santos Galeano and Tiago Espinha Gasiba and Sathwik Amburi and Maria Pinto-Albuquerque 2025 Is Part Of OASIcs, Volume 133, 6th International Computer Programming Education Conference (ICPEC 2025) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/OASIcs.ICPEC.2025.9 urn:nbn:de:0030-drops-240395 https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.ICPEC.2025.9 eng https://creativecommons.org/licenses/by/4.0/legalcode