ai-research-survey

scan.json (32905B)

---

 {
   "paper": {
     "title": "Secure Coding with AI – From Detection to Repair: Vulnerability Analysis and Fixing Using Large Language Models",
     "authors": [
       "Vladislav Belozerov",
       "Peter J Barclay",
       "Ashkan Sami"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2504.20814"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "observational"],
   "key_findings": "Analysis of 2,315 C/C++/C# code snippets from the DevGPT dataset identified 56 confirmed vulnerabilities in 48 files. LLM vulnerability detection improved substantially from October 2024 (GPT-4o at ~53-56%) to September 2025 (GPT-4.1, GPT-5, Claude Opus 4.1 at ~78-82%), though data contamination cannot be ruled out. User-provided code and GPT-generated code showed roughly equal vulnerability rates (25 vs 31 of 56 issues). All models exhibited false positives and sycophantic behavior, over-reporting issues even in safe code.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides a GitHub repository with software tools [17] (https://github.com/vlad2010/MS_DataEngineering_Public) and a results repository [34] (https://github.com/vlad2010/MSc_DataEngineering_Results)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The DevGPT dataset is publicly available on Zenodo [14]. Results including LLM outputs and analysis are shared in the GitHub results repository [34]. Section 10.5 confirms data availability."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "While static scanner versions are listed in Table 5 (Snyk 1.1294.0, Semgrep 1.87.0, FlawFinder 2.0.19, CppCheck 2.14.0), there is no requirements.txt, Dockerfile, or detailed environment specification for reproducing the Python tooling or analysis pipeline."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The paper describes the methodology conceptually but does not include a README or scripts to replicate the main experiments end-to-end."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., '82.14%', '78.57%') with no confidence intervals or error bars. Tables 12, 17, and 18 show only raw counts and percentages."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims models 'performed about the same, roughly 80%' and that there was 'substantial improvement' from 2024 to 2025, but no statistical significance tests are applied to any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides baseline context for improvements: 'from roughly 50% to around 75–80%' (abstract), and per-model breakdowns (e.g., GPT-4.1 detected 82.14% vs GPT-4o's ~56%), allowing readers to assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The sample of 56 confirmed vulnerabilities in 48 files is not justified by power analysis or any rationale. Section 7.2 acknowledges 'The sample size is relatively small' but offers no justification for why this size is adequate for the claims."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Single-run results are reported for each model. Section 7.3 acknowledges 'the inherent non-determinism of LLMs' outputs' but no variance, standard deviation, or repeat-run results are provided."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The October 2024 GPT-4o results serve as a temporal baseline for the 2025 experiment. Static scanners (Flawfinder, Snyk, Semgrep, Cppcheck) serve as reference detection tools in the detection matrices (Tables 10, 15, 16)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The September 2025 experiment uses GPT-4.1, GPT-5, and Claude Opus 4.1 — current-generation models at the time of the experiment. Static scanners also used recent versions (Table 5)."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation involves prompting LLMs with a single fixed prompt on code snippets. There is no multi-component system whose components could be ablated."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two distinct metrics are reported for each model: detection rate (whether the LLM identified the vulnerability) and fixing rate (whether the LLM produced a correct fix). Tables 12, 17, and 18 present both."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "All results were manually reviewed. Section 5.3: 'results for all 114 files were manually reviewed by the first author and the findings were discussed and validated by the second and third authors.' LLM outputs were also manually verified."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "No tuning was performed on the evaluation data. The paper uses zero-shot prompting with a fixed prompt (Section 6.2). Temperatures were set based on general literature recommendations [3], not based on this evaluation data. The evaluation set functions as a pure test set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by programming language (Table 9), by CWE type (Table 8), by source of code (user vs GPT-generated, Tables 17-18), by model (Table 12), and by DevGPT snapshot (Tables 13-14)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Multiple detailed failure cases are discussed: false positive on fprintf (Listing 1, Finding 6), sycophantic over-correction of safe code (Listings 2-3, Finding 8), incorrect CWE classification (Listing 4, Finding 9), and silent fix without explanation (Finding 11)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports GPT-4o's poor 2024 performance (~50% success, Finding 3), cases where all models failed to detect issues (e.g., CWE-22 path traversal in Tables 15-16), and sycophantic behavior where models reported non-existent vulnerabilities (Finding 6)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims about 56 vulnerabilities in 48 files, per-model detection/fixing rates (46/44/45 detected, 42/44/43 fixed), improvement from ~50% to ~75-80%, and equal vulnerability rates in user vs GPT code are all substantiated in Sections 5-6 and Tables 12-18."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "Finding 5 states 'vulnerability detection and fixing performance improved significantly' and 'This represents a substantial increase in capability within one year.' This implies genuine model improvement but the study design — different models, different time points, partially different datasets, public availability of the preprint — cannot support causal inference. Section 7.2 acknowledges contamination but the framing still treats it as genuine improvement."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Secure Coding with AI – From Detection to Repair' and abstract language about 'current LLMs' are broader than the tested setting of 56 vulnerabilities in C/C++/C# from one dataset. Section 7.2 acknowledges limited generalizability but the title and framing overreach."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses multiple alternative explanations: data contamination from the preprint being public (7.2), false negatives from scanners (7.1), selection bias in manual file review (7.1), and non-determinism of LLM outputs (7.3)."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures vulnerability detection rate and fixing rate against scanner-confirmed issues, and frames results accordingly. The measurements match the claim granularity — they claim to measure detection/fixing ability and measure exactly that. They acknowledge scanners may miss issues (Section 7.1), noting the proxy limitation."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section 6.1 specifies GPT-5 (2025-08-07), GPT-4.1 (2025-04-14), and Claude Opus 4.1 (2025-08-05) with dates, but the first experiment uses 'GPT-4o, without specifying version and with the default temperature 1.0.' GPT-4o, a key baseline model, lacks a version or snapshot identifier."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The exact prompt text used in experiments is provided verbatim in Section 6.2, including the original misspelling. The paper states the same prompt was used in 2025 with the spelling corrected."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 and 6.3 report temperatures: GPT-4o default 1.0, GPT-5 temperature 1.0, GPT-4.1 temperature 0.1, Claude Opus 4.1 temperature 0.1. Temperature selection rationale is referenced [3]."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper uses simple single-shot API prompts with no tools, retry logic, or multi-step reasoning."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Sections 4 and 5.2 describe the data pipeline in detail: DevGPT extraction, folder structure, file selection algorithm with explicit criteria (scanner detection required, one file per sharing, deduplication, snapshot exclusion). The pipeline stages are documented with counts (2,315 files → 114 selected → 48 with confirmed issues)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 'Threats to Validity' contains three substantive subsections: Internal Validity (7.1), External Validity (7.2), and Construct Validity (7.3)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses study-specific threats: incomplete vulnerability detection by scanners (7.1), subjective bias in file selection by three authors (7.1), data contamination from the preprint being publicly available between experiments (7.2), and LLM non-determinism affecting reproducibility (7.3)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 states: 'our analysis was focused on DevGPT and was limited to 56 security issues across 48 files, which may not be sufficient to generalise the findings.' They explicitly bound to C/C++/C# and the DevGPT dataset."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The DevGPT dataset is publicly available on Zenodo [14]. All LLM responses and analysis results are in the GitHub repository [34]. The original code snippets and model outputs can be independently verified."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 describes data extraction from DevGPT in detail: version used (v10), snapshots selected (20231012 and 20240514), folder structure, extraction tools, and file organization. Table 2 and 3 provide dataset statistics."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The data source is the publicly available DevGPT dataset, which is a curated research dataset of developer-AI interactions."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: DevGPT extraction (Section 4), static scanning (Section 5.1), file selection algorithm with criteria (Section 5.2, from 2,315 files to 114 selected), manual validation (Section 5.3, 56 confirmed issues in 48 files), and LLM evaluation (Section 6). Figure 1 provides a dataflow diagram."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Section 10.1 explicitly states: 'The research received no external funding.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors are listed as affiliated with Edinburgh Napier University, Edinburgh, Scotland. They are independent academic researchers evaluating third-party commercial LLMs."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "The research received no external funding (Section 10.1), so the question of funder independence is not applicable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "Section 10.6 states: 'The authors have no competing interests to declare.'"
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the models used (GPT-4o, GPT-4.1, GPT-5, Claude Opus 4.1). This is significant because the DevGPT dataset is public and could have been in training data."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 explicitly discusses this: 'since our paper and dataset were publicly available online between these experiments, the observed improvement may reflect data leakage (the LLMs being trained on our online paper and DevGPT being online) rather than genuine model performance improvements.'"
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 addresses contamination as a major threat: 'This threatens the generalisability of conclusions about models' improvements over time, as the results may not reflect true capability gains but rather exposure to our specific evaluation data.' Also noted in Section 6.3."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The study analyzes code snippets from a public dataset and evaluates LLM outputs."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Section 10.2 confirms: 'Not applicable' for ethical approval."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates code and LLM outputs, not human behavior."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. File selection criteria for code snippets are documented in Section 5.2, but these are not participant recruitment criteria."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants and no experimental conditions requiring randomization."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The manual review was conducted by the authors who were aware of the study design."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, tokens consumed, or wall-clock time are reported for any of the LLM evaluations across the 114 files and 4 models."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or processing time is stated for either the 2024 or 2025 experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results are single-run per model. Section 7.3 acknowledges 'the model can produce different responses to the same prompt on different occasions' but no multi-seed or repeat-run results are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never explicitly stated. The results appear to be from a single evaluation per model, but this is implied rather than stated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Temperature settings were selected based on general literature recommendations [3] rather than a systematic search. No search budget is reported, and the rationale for using 0.1 for some models and 1.0 for others is not thoroughly justified."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 justifies temperature selection: 'Temperature was selected based on the observation that lower temperature is better for technical and code-generation tasks, and LLMs behave more predictably at lower temperatures [3].' While this doesn't explain why GPT-5 used 1.0, the general selection criterion is stated."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes multiple comparisons across 4 models, 2 time points, 2 code sources, and 3 languages without any statistical tests at all, let alone multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The authors evaluate third-party commercial LLMs (OpenAI, Anthropic), not their own system. Self-comparison bias is not applicable."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "All models are accessed via commercial APIs with simple single-shot prompts. Compute differences between models are not under the authors' control and are not meaningfully comparable."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the 56 scanner-confirmed vulnerabilities constitute a valid benchmark for measuring LLM security capabilities. Issues like whether static-scanner-detectable vulnerabilities are representative of real-world security problems, or whether the selection methodology biases toward certain vulnerability types, are not addressed."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is used. Simple single-shot API prompts are sent directly to each model."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 explicitly discusses temporal leakage: the DevGPT dataset and the preprint were publicly available between the 2024 and 2025 experiments, meaning models may have trained on the specific code and vulnerabilities being tested."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the prompt itself (which explicitly asks to find security issues) provides hints that would not be available in real-world usage, or whether the framing of the evaluation leaks information about expected findings."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the code snippets from DevGPT share structural similarities (e.g., same developers, similar coding patterns, duplicate or near-duplicate code). Snippets from the same 'Sharing' are filtered but cross-sharing similarity is not addressed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection method is applied. The paper only discusses contamination risk conceptually in Section 7.2 without using canary strings, membership inference, n-gram overlap, or other detection techniques."
       }
     }
   },
   "claims": [
     {
       "claim": "Out of 2,315 code snippets from DevGPT, 56 vulnerabilities were confirmed in 48 files after static scanning and manual review.",
       "evidence": "Section 5.3 and Table 12: static scanners detected potential issues in 114 files, manual review confirmed 56 vulnerabilities across 48 files. CWE distribution in Table 8.",
       "supported": "strong"
     },
     {
       "claim": "LLM vulnerability detection and fixing improved substantially from October 2024 (~53-56%) to September 2025 (~78-82%).",
       "evidence": "Section 6.2-6.3 and Table 12: GPT-4o detected 56%/fixed 53% in 2024; GPT-4.1 detected 82.1%/fixed 75%, GPT-5 detected and fixed 78.6%, Claude Opus 4.1 detected 80.4%/fixed 76.8% in 2025.",
       "supported": "moderate"
     },
     {
       "claim": "All three 2025 LLMs performed comparably at approximately 78% detection and fixing accuracy.",
       "evidence": "Table 12 shows GPT-4.1 at 82.1%/75%, GPT-5 at 78.6%/78.6%, Claude Opus 4.1 at 80.4%/76.8%. Finding 4 summarizes this.",
       "supported": "moderate"
     },
     {
       "claim": "LLM-generated code is about as likely to contain vulnerabilities as developer-written code.",
       "evidence": "Tables 17-18: 25 of 56 issues in user-provided code vs 31 in GPT-generated code. Finding 13 states 44.6% of issues were in user code.",
       "supported": "weak"
     },
     {
       "claim": "LLMs exhibit sycophantic behavior, reporting non-existent vulnerabilities and making unnecessary modifications to safe code.",
       "evidence": "Findings 6-8: Listing 1 shows a single fprintf line where all LLMs reported multiple non-existent CWEs. Listings 2-3 show unnecessary modification of already-safe memcpy code. Models 'are trying to satisfy the user who asked them to find security problems.'",
       "supported": "moderate"
     },
     {
       "claim": "C has the highest vulnerability detection density among the three languages tested.",
       "evidence": "Table 9: C had 10.4 lines per detected issue vs C++ at 83.8 and C# at 2,937.5. Finding 2.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Very small sample size",
       "detail": "Only 56 confirmed vulnerabilities across 48 files form the evaluation set. This is extremely small for claims about LLM security capabilities, especially given 23 different CWE types. Many CWE categories have only 1-2 instances, making per-category conclusions unreliable."
     },
     {
       "flag": "No statistical tests or uncertainty quantification",
       "detail": "All comparisons between models and between time periods are based on raw percentages from single runs with no confidence intervals, significance tests, or repeat experiments. With n=56, the difference between 78.6% and 82.1% could easily be noise."
     },
     {
       "flag": "Single-run non-deterministic evaluation",
       "detail": "Section 7.3 acknowledges LLM non-determinism but all results come from single runs per model. The paper itself states 'The model can produce different responses to the same prompt on different occasions' yet does not run multiple trials."
     },
     {
       "flag": "Data contamination between experiments",
       "detail": "The preprint and DevGPT dataset were publicly available between the October 2024 and September 2025 experiments. The observed improvement from ~50% to ~78% may reflect training on the specific evaluation data rather than genuine capability gains. The paper acknowledges this but still frames results as model improvement."
     },
     {
       "flag": "Inconsistent temperature settings across models",
       "detail": "GPT-5 used temperature 1.0 while GPT-4.1 and Claude Opus 4.1 used 0.1. Higher temperature increases output variability, potentially disadvantaging GPT-5 in the comparison. The paper references general literature for the 0.1 choice but does not explain why GPT-5 was not also set to 0.1."
     },
     {
       "flag": "Manual selection introduces bias",
       "detail": "The file selection process (Section 5.2) involves multiple subjective decisions: which files are 'most interesting,' manual deduplication, and single-file selection per 'Sharing.' Section 7.1 acknowledges this may introduce bias."
     }
   ],
   "cited_papers": [
     {
       "title": "Using GPT as a static application security testing tool",
       "authors": ["A. Bakhshandeh", "A. Keramatfar", "A. Norouzi", "M. M. Chekidehkhoun"],
       "year": 2023,
       "arxiv_id": "2308.14434",
       "relevance": "Directly compares GPT-3.5 with static analysis tools (Bandit, Semgrep, SonarQube) for vulnerability detection in Python code."
     },
     {
       "title": "Evaluation of GPT Model for Vulnerability Detection",
       "authors": ["A. Cheshkov", "P. Zadorozhny", "R. Levichev"],
       "year": 2023,
       "arxiv_id": "2304.07232",
       "relevance": "Evaluates GPT-3 and GPT-3.5-turbo for vulnerability detection in Java, finding significant limitations and biases."
     },
     {
       "title": "GPT for Vulnerability Detection, Classification, and Repair: How Far Are We?",
       "authors": ["M. Fu", "C. K. Tantithamthavorn", "V. Nguyen", "T. Le"],
       "year": 2023,
       "doi": "10.1109/APSEC60848.2023.00085",
       "relevance": "Evaluates GPT on four vulnerability-related tasks using real-life datasets, finding it underperforms compared to specialized models like CodeBERT."
     },
     {
       "title": "Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions",
       "authors": ["H. Pearce", "B. Ahmad", "B. Tan", "B. Dolan-Gavitt", "R. Karri"],
       "year": 2021,
       "arxiv_id": "2108.09293",
       "relevance": "Early assessment of Copilot code generation security, finding instances of insecure coding practices."
     },
     {
       "title": "Do Users Write More Insecure Code with AI Assistants?",
       "authors": ["N. Perry", "M. Srivastava", "D. Kumar", "D. Boneh"],
       "year": 2023,
       "doi": "10.1145/3576915.3623157",
       "relevance": "User study examining whether AI coding assistants lead to more insecure code, directly relevant to the impact of LLM-assisted development."
     },
     {
       "title": "How secure is code generated by GPT?",
       "authors": ["R. Khoury", "A. R. Avila", "J. Brunelle", "B. M. Camara"],
       "year": 2023,
       "doi": "10.1109/SMC53992.2023.10394237",
       "relevance": "Evaluates 21 GPT-generated programs across five languages for specific vulnerabilities including SQL injection and memory corruption."
     },
     {
       "title": "Exploring the limits of GPT in software security applications",
       "authors": ["F. Wu", "Q. Zhang", "A. P. Bajaj", "T. Bao", "N. Zhang", "R. Wang", "C. Xiao"],
       "year": 2023,
       "arxiv_id": "2312.05275",
       "relevance": "Compares GPT-3.5 and GPT-4 on seven security tasks including vulnerability detection, repair, debugging, and fuzzing."
     },
     {
       "title": "Fight Fire With Fire: How Much Can We Trust GPT on Source Code-Related Tasks?",
       "authors": ["X. Yu", "L. Liu", "X. Hu", "J. W. Keung", "J. Liu", "X. Xia"],
       "year": 2024,
       "doi": "10.1109/TSE.2024.3492204",
       "relevance": "Evaluates GPT's self-verification ability, finding it frequently misjudges its own code and shows self-contradictory behavior."
     },
     {
       "title": "Do LLMs Consider Security? An Empirical Study on Responses to Programming Questions",
       "authors": ["A. Sajadi", "B. Le", "A. Nguyen", "K. Damevski", "P. Chatterjee"],
       "year": 2025,
       "arxiv_id": "2502.14202",
       "relevance": "Tests Claude 3, GPT-4, and Llama 3 on Stack Overflow snippets with known vulnerabilities, finding models don't warn about security unless prompted."
     },
     {
       "title": "Security and Quality in LLM-Generated Code: A Multi-Language, Multi-Model Analysis",
       "authors": ["M. Kharma", "S. Choi", "M. AlKhanafseh", "D. Mohaisen"],
       "year": 2025,
       "arxiv_id": "2502.01853",
       "relevance": "Comprehensive study of modern LLMs (GPT-4, Claude-3.5, Gemini-1.5, Llama-3) on 200 coding tasks identifying hidden security risks."
     },
     {
       "title": "Just another copy and paste? Comparing the security vulnerabilities of GPT generated code and StackOverflow answers",
       "authors": ["S. Hamer", "M. d'Amorim", "L. Williams"],
       "year": 2024,
       "relevance": "Compares GPT-generated Java code with StackOverflow answers using CodeQL, finding GPT produced 20% fewer vulnerabilities but still 248 issues."
     },
     {
       "title": "Security Weaknesses of Copilot Generated Code in GitHub: An empirical study",
       "authors": ["Y. Fu", "P. Liang", "A. Tahir", "Z. Li", "M. Shahin", "J. Yu", "J. Chen"],
       "year": 2023,
       "relevance": "Empirical study of Copilot-generated code security weaknesses found in actual GitHub repositories."
     },
     {
       "title": "A Qualitative Study on Using GPT for Software Security: Perception vs. Practicality",
       "authors": ["M. M. Kholoosi", "M. A. Babar", "R. Croft"],
       "year": 2024,
       "doi": "10.1109/TPS-ISA62245.2024.00022",
       "relevance": "Qualitative study of security professionals' experiences using GPT-3.5 for vulnerability detection and penetration testing."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Practitioners can use the findings to calibrate trust in LLM security analysis, though no new tool or technique is provided."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Results mostly confirm expected findings — LLMs are imperfect at security analysis — though the ~78% improvement over 50% and the sycophancy observations add some nuance."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Raises concerns about LLM-generated code security and the risk of confident false reassurance, relevant to developers relying on AI coding assistants."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no conflict with vendors or other researchers. Academic evaluation with straightforward findings."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code tools and results are on GitHub but there is no interactive demo or pip-installable tool."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Evaluates GPT-5, GPT-4.1, and Claude Opus 4.1 — well-known models from leading AI labs — but the paper itself comes from a lesser-known university."
     }
   }
 }