Security vulnerability analysis of code generated with artificial intelligence

In this thesis, the security risks and vulnerabilities associated with artificial intelligence-based code generation tools are comprehensively examined. In recent years, the rapid digital transformation in the information technology and software sectors has led to the widespread adoption of large language models (LLMs) and artificial intelligence technologies in software development processes. Modern code generation tools such as GitHub Copilot, ChatGPT, and Cursor AI offer significant speed and efficiency gains for developers; however, they also introduce uncertainties and potential risks regarding the security of the generated code. In this study, the most common security vulnerabilities listed in the 2024 CWE Top 25 were taken as a reference. For each vulnerability type, hundreds of code samples were generated using selected AI tools in three different programming languages (C#, Python, and TypeScript), with ten samples per language for each vulnerability. The generated codes were subjected to both automated security analysis tools and manual review, and the detected security issues were evaluated in detail according to CWE and OWASP criteria. The analysis revealed that the most frequently observed vulnerabilities were cross-site scripting (XSS), SQL injection, and authorization weaknesses. Approximately one-fourth of the code samples contained critical security risks. Furthermore, it was observed that there are notable differences in the security performance of different AI tools, with some tools being more prone to certain vulnerabilities. In conclusion, while AI-assisted code generation provides substantial speed and convenience in software projects, security risks must not be overlooked. Code generated by AI should always be reviewed by humans and subjected to comprehensive security testing to ensure the development of secure and sustainable software.