Jul 2026· International Conference on Artificial Intelligence Testing· pp. 68-75· 0 citations· 25 references
Abstract
Command injection vulnerabilities remain a significant security threat in dynamic languages such as Python, particularly in widely used open-source projects. Recent advances in large language models (LLMs) have shown strong potential in code-related tasks, motivating their application to vulnerability detection.In this paper, we evaluate LLM-based approaches for detecting command injection vulnerabilities and generating security tests. We apply our method to six widely used GitHub projects—Django, Flask, TensorFlow, Scikit-learn, PyTorch, and LangChain—covering over 50,000-star repositories with broad real-world usage. Our study analyzes the effectiveness of LLMs in terms of detection accuracy, efficiency, and practical applicability.We further compare multiple LLMs to assess their relative performance in vulnerability detection and test generation. The results demonstrate that LLM-based approaches can effectively identify vulnerabilities in both complete and fragmented code while providing executable security tests for validation. Our findings highlight the strengths and limitations of LLMs and offer practical insights for leveraging them to enhance automated software security testing.
The increasing deployment of Large Language Models (LLMs) in critical infrastructure has introduced a class of security risks that remain insufficiently characterised and poorly tooled in practice. Attack vectors including prompt injection, jailbreaking, code execution facilitation, covert data exfiltration, and training data poisoning present quantifiable threats to systems that rely on LLM outputs, yet no lightweight, provider-agnostic tool exists to measure these risks systematically. This paper presents VectorSec, an open-source, web-based LLM security scanner built with Python and Dash. The tool executes a structured test suite of 320 adversarial prompts spanning 16 vulnerability categories aligned with the OWASP Top 10 for LLMs. Each response is scored through a four-stage pipeline combining pattern matching, sentiment analysis, semantic similarity, and secondary LLM verification. Evaluation across three open-source models demonstrates that pattern-matching-only filtering misses approximately 15% of High and Critical findings that semantic verification correctly identifies, motivating the multi-layer design. VectorSec provides interactive dashboard reporting, real-time progress tracking, and audit-ready PDF and CSV exports, lowering the barrier to structured LLM security assessment in operational settings.
M. Yamin· International Conference on...· 0 citations
The application of LLMs for detecting malicious PowerShell scripts and producing human-interpretable explanations for their classification decisions are investigated, showing that LLMs are capable of identifying and explaining malicious PowerShell scripts, although performance varies across different models.
Meng Wang, Emma Topolovec, B. Arana et al.· 0 citations
Large language models (LLMs) are increasingly used for code generation, yet they remain vulnerable to prompts that elicit insecure implementations. Existing defenses typically rely on predefined threat models or known vulnerability patterns, limiting their effectiveness against novel attacks. We propose CodeSIFT, a threat-model-agnostic detection method that leverages influence functions to identify batches of prompts that induce anomalous model behavior. Rather than detecting specific vulnerabilities, CodeSIFT measures the parameter-space influence of generated code and uses a statistical test to determine whether a candidate prompt set deviates from a benign reference distribution. To evaluate our approach, we introduce two benchmark datasets covering a variety of vulnerabilities. We evaluate CodeSIFT on three open-weight code LLMs ranging from 3B to 7B parameters, achieving AUROC scores of up to 0.98 at moderate-to-high injection rates, while maintaining well-calibrated false positive rates and substantially outperforming static analysis baselines. These results suggest that influence-function-based detection is a promising direction for identifying malicious code-generation prompts without requiring prior knowledge of the underlying attack class.
Francesco Quinzan, Noor Munir, Yi-Shun Lu et al.· 0 citations
Findings show that insecure code generation is not merely a collection of independent defects, but a structured and prompt-conditioned phenomenon, motivating cluster-aware verification and prompt-level intervention for safer LLM-assisted programming.
VICBench enables robust evaluation of vulnerability detection approaches and shows that state-of-the-art algorithms V-SZZ and LLM4SZZ achieve only 33.3%-40.1% F1, confirming that using existing approaches still entails significant manual effort.
Jin Lu, Xuening Han, Yan Zhong et al.· 0 citations
Software vulnerability detection using Static Application Security Testing tools still produces a high number of false positives, which increases the burden of manual verification for developers. A high false positive rate can reduce development efficiency, divert attention from critical vulnerabilities, and indicate a gap between automated detection results and the actual security condition of the code. Addressing this issue is essential to ensure that automated security testing remains a reliable and efficient part of the software development lifecycle. This research proposes the integration of Snyk AI with the Large Language Model GPT-4 as a post-processing validation mechanism based on contextual reasoning. This approach leverages the contextual understanding capability of GPT-4 to re-evaluate flagged vulnerabilities and distinguish genuine security risks from false alarms. The evaluation was conducted on 180 Java source codes from the OWASP Benchmark by comparing the initial detection results with the validation results. Snyk AI produced 53 false positives with an error rate of 29.44%, and after integration with GPT-4, 26 alerts were successfully corrected, resulting in a 49.1% reduction in false positives. These results demonstrate that the integration of GPT-4 effectively improves the quality of software security detection, offering a promising direction for reducing manual verification effort in real-world development environments.
Danu Tryas Pristowo, Dana Sulistiyo Kusumo· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
