Researchers Found 1,540 Security Holes in AI-Written Code
AI now writes much of your software — and it's quietly leaving doors unlocked.
Researchers built a new public dataset, called LLMVul, of LLM-generated C/C++ functions mined from real production repositories. They mined AI-assisted development activity from GitHub over a 4-year period, from November 13, 2022 to September 3, 2026, using provenance signals such as commit metadata and AI-related authorship evidence. After filtering and deduplication, LLMVul contains 21,430 unique C/C++ functions from 226 repositories. Of those, 1,540 are ensemble-vulnerable functions spanning 17 unique CWE categories — substantially more real-world LLM-generated vulnerable C/C++ functions than existing vulnerability-oriented LLM code benchmarks. The dataset is publicly available.
- A new public database called LLMVul catalogs 21,430 pieces of AI-assisted C/C++ code taken from 226 real GitHub projects, not lab experiments.
- 1,540 of those functions had confirmed security weaknesses, falling into 17 categories like memory errors attackers can exploit.
- It's the largest real-world collection of its kind, giving developers and AI companies a way to spot and fix the mistakes AI keeps making.
Why It Matters
AI-written code is already inside your apps and devices; this catalog helps catch its security holes before attackers do.