All That Glitters is Not Gold: Vulnerability-Driven Repairing in ChatGPT-Generated C Source Code
Resumo
Large language models (LLMs) are increasingly used for source code generation, yet they may produce vulnerable code. This study investigates security vulnerabilities in GPT-4-generated C programs and evaluates whether they can be automatically repaired. We generated solutions for 974 C programming tasks using GPT-4, collected four independent generations per task, and analyzed them with the GCC static analyzer. Detected issues were mapped to the Common Weakness Enumeration (CWE) taxonomy, and an iterative self-healing framework was used to repair vulnerable code based on static-analysis feedback. Vulnerabilities were detected in approximately 17% of the generated programs, spanning 10 CWEs grouped into three CWE pillars, with CWE-690 (Unchecked Return Value to NULL Pointer Dereference) and CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior) being the most frequent. The proposed framework eliminated all vulnerabilities detected by the static analyzer within 4–7 repair rounds across the four samples, without human intervention. These results demonstrate that iterative LLM-assisted repair guided by static-analysis feedback is an effective strategy for mitigating vulnerabilities in GPT-4-generated C code.
Palavras-chave:
Vulnerability Analysis, Large Language Models, Source Code Generation, Automatic Program Repair
Referências
Baleegh Ahmad et al. 2024. On hardware security bug code fixes by prompting large language models. IEEE Transactions on Information Forensics and Security 19 (2024), 4043–4057.
Jacob Austin et al. 2021. Program synthesis with large language models. arXiv preprint arXiv:2108.07732 (2021). [link]
Mauro Cazzaniga et al. 2024. Gen-AI: Artificial Intelligence and the Future of Work. Staff Discussion Notes 2024, 001 (2024). DOI: 10.5089/9798400262548.006
Erik Derner and Kristina Batistič. 2023. Beyond the Safeguards: Exploring the Security Risks of ChatGPT. arXiv preprint arXiv:2305.08005 (2023).
Free Software Foundation. 2023. Static Analyzer Options (Using the GNU Compiler Collection (GCC)). [link] Accessed: August 11, 2026.
Xinyi Hou, Yanjie Zhao, Yue Liu, Zhou Yang, Kailong Wang, Li Li, Xiapu Luo, David Lo, John Grundy, and Haoyu Wang. 2024. Large language models for software engineering: A systematic literature review. ACM Transactions on Software Engineering and Methodology 33, 8 (2024), 1–79.
Maria Joseph Israel and Ahmed Amer. 2023. Rethinking data infrastructure and its ethical implications in the face of automated digital content generation. AI and Ethics 3, 2 (2023), 427–439.
Matthew Jin et al. 2023. Inferfix: End-to-end program repair with llms. In Proceedings of the 31st ACM joint european software engineering conference and symposium on the foundations of software engineering. 1646–1656. DOI: 10.1145/3611643.3613892
Harshit Joshi et al. 2023. Repair is nearly generation: Multilingual program repair with llms. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 5131–5140. DOI: 10.1609/aaai.v37i4.25642
Raphaël Khoury et al. 2023. How Secure is Code Generated by ChatGPT?. In IEEE International Conference on Systems, Man, and Cybernetics (SMC). DOI: 10.1109/SMC53992.2023.10394237
Sam Lau and Philip Guo. 2023. From Ban it till we understand it to Resistance is futile: How university programming instructors plan to adapt as more students use AI code generation and explanation tools such as ChatGPT and GitHub Copilot. In Proceedings of the 2023 ACM Conference on International Computing Education Research-Volume 1. 106–121. DOI: 10.1145/3568813.3600138
MITRE Corporation. 2024. CWE VIEW: Research Concepts (CWE-1000), CWE Version 4.20. [link] Accessed: August 24, 2026.
David Noever. 2023. Can large language models find and fix vulnerable software? arXiv preprint arXiv:2308.10345 (2023).
Hammond Pearce et al. 2022. Asleep at the keyboard? assessing the security of github copilot’s code contributions. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 754–768. DOI: 10.1109/SP46214.2022.9833571
Hammond Pearce et al. 2023. Examining zero-shot vulnerability repair with large language models. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2339–2356. DOI: 10.1109/SP46215.2023.10179420
Neil Perry et al. 2023. Do users write more insecure code with AI assistants?. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 2785–2799. DOI: 10.1145/3576915.3623157
Gustavo Sandoval et al. 2023. Lost at c: A user study on the security implications of large language model code assistants. In 32nd USENIX Security Symposium (USENIX Security 23). 2205–2222.
Krzysztof Wach et al. 2023. The dark side of generative artificial intelligence: A critical analysis of controversies and risks of ChatGPT. Entrepreneurial Business and Economics Review 11, 2 (2023), 7–30.
Jules White et al. 2023. A prompt pattern catalog to enhance prompt engineering with chatgpt. arXiv preprint arXiv:2302.11382 (2023).
Claes Wohlin et al. 2012. Experimentation in software engineering. Vol. 236. Springer.
Fangzhou Wu, Xiaogeng Liu, and Chaowei Xiao. 2023. DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructions. arXiv preprint arXiv:2312.04730 (2023).
Chunqiu Steven Xia and Lingming Zhang. 2024. Automated Program Repair via Conversation: Fixing 162 out of 337 Bugs for $0.42 Each Using ChatGPT. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis. 819–831.
Quanjun Zhang et al. 2023. A critical review of large language model on software engineering: An example from chatgpt and automated program repair. arXiv preprint arXiv:2310.08879 (2023).
Jacob Austin et al. 2021. Program synthesis with large language models. arXiv preprint arXiv:2108.07732 (2021). [link]
Mauro Cazzaniga et al. 2024. Gen-AI: Artificial Intelligence and the Future of Work. Staff Discussion Notes 2024, 001 (2024). DOI: 10.5089/9798400262548.006
Erik Derner and Kristina Batistič. 2023. Beyond the Safeguards: Exploring the Security Risks of ChatGPT. arXiv preprint arXiv:2305.08005 (2023).
Free Software Foundation. 2023. Static Analyzer Options (Using the GNU Compiler Collection (GCC)). [link] Accessed: August 11, 2026.
Xinyi Hou, Yanjie Zhao, Yue Liu, Zhou Yang, Kailong Wang, Li Li, Xiapu Luo, David Lo, John Grundy, and Haoyu Wang. 2024. Large language models for software engineering: A systematic literature review. ACM Transactions on Software Engineering and Methodology 33, 8 (2024), 1–79.
Maria Joseph Israel and Ahmed Amer. 2023. Rethinking data infrastructure and its ethical implications in the face of automated digital content generation. AI and Ethics 3, 2 (2023), 427–439.
Matthew Jin et al. 2023. Inferfix: End-to-end program repair with llms. In Proceedings of the 31st ACM joint european software engineering conference and symposium on the foundations of software engineering. 1646–1656. DOI: 10.1145/3611643.3613892
Harshit Joshi et al. 2023. Repair is nearly generation: Multilingual program repair with llms. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 5131–5140. DOI: 10.1609/aaai.v37i4.25642
Raphaël Khoury et al. 2023. How Secure is Code Generated by ChatGPT?. In IEEE International Conference on Systems, Man, and Cybernetics (SMC). DOI: 10.1109/SMC53992.2023.10394237
Sam Lau and Philip Guo. 2023. From Ban it till we understand it to Resistance is futile: How university programming instructors plan to adapt as more students use AI code generation and explanation tools such as ChatGPT and GitHub Copilot. In Proceedings of the 2023 ACM Conference on International Computing Education Research-Volume 1. 106–121. DOI: 10.1145/3568813.3600138
MITRE Corporation. 2024. CWE VIEW: Research Concepts (CWE-1000), CWE Version 4.20. [link] Accessed: August 24, 2026.
David Noever. 2023. Can large language models find and fix vulnerable software? arXiv preprint arXiv:2308.10345 (2023).
Hammond Pearce et al. 2022. Asleep at the keyboard? assessing the security of github copilot’s code contributions. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 754–768. DOI: 10.1109/SP46214.2022.9833571
Hammond Pearce et al. 2023. Examining zero-shot vulnerability repair with large language models. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2339–2356. DOI: 10.1109/SP46215.2023.10179420
Neil Perry et al. 2023. Do users write more insecure code with AI assistants?. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 2785–2799. DOI: 10.1145/3576915.3623157
Gustavo Sandoval et al. 2023. Lost at c: A user study on the security implications of large language model code assistants. In 32nd USENIX Security Symposium (USENIX Security 23). 2205–2222.
Krzysztof Wach et al. 2023. The dark side of generative artificial intelligence: A critical analysis of controversies and risks of ChatGPT. Entrepreneurial Business and Economics Review 11, 2 (2023), 7–30.
Jules White et al. 2023. A prompt pattern catalog to enhance prompt engineering with chatgpt. arXiv preprint arXiv:2302.11382 (2023).
Claes Wohlin et al. 2012. Experimentation in software engineering. Vol. 236. Springer.
Fangzhou Wu, Xiaogeng Liu, and Chaowei Xiao. 2023. DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructions. arXiv preprint arXiv:2312.04730 (2023).
Chunqiu Steven Xia and Lingming Zhang. 2024. Automated Program Repair via Conversation: Fixing 162 out of 337 Bugs for $0.42 Each Using ChatGPT. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis. 819–831.
Quanjun Zhang et al. 2023. A critical review of large language model on software engineering: An example from chatgpt and automated program repair. arXiv preprint arXiv:2310.08879 (2023).
Publicado
11/09/2026
Como Citar
LEITE NETO, Clodoaldo B.; XU, Haitao; OLIVEIRA, Gabriel H. M.; ALBUQUERQUE, Danyllo; GHEYI, Rohit; PERKUSICH, Mirko.
All That Glitters is Not Gold: Vulnerability-Driven Repairing in ChatGPT-Generated C Source Code. In: WORKSHOP BRASILEIRO DE ENGENHARIA DE SOFTWARE INTELIGENTE (ISE), 5. , 2026, São Paulo/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 107-112.
DOI: https://doi.org/10.5753/ise.2026.33108.
