April 24, 2023
According to a recent pre-print research by computer scientists at Canada’s Université du Québec, OpenAI’s ChatGPT, which is based on language models, generates code that is laced with security vulnerabilities.
The researchers asked ChatGPT to construct 21 programs and scripts in C, C++, Python, and Java to find security issues. During its early tries, the bot was only able to produce five secure scripts. It succeeded to generate an extra seven secure apps after being pushed further, but only for the specific vulnerability being evaluated and did not ensure that the code was resistant to other potential flaws.
The researchers’ findings have raised concerns about the use of language models to produce code, especially in cases where security is critical. Despite its capacity to produce code, ChatGPT did not recognize its limitations, and the model did not take an adversarial approach to code execution, frequently stating that security vulnerabilities could be avoided by merely not supplying wrong inputs to the defective program it had created.
Although corporations want to use AI models for a variety of jobs such as developing corporate strategies, creating marketing plans, and building websites, AI is yet incapable of replacing programmers. Despite the promising performance of Auto-GPT, an open-source program created by Toran Bruce Richards that uses OpenAI’s text-generation models to connect with online apps and services, configuring and operating it requires significant forethought and experience. The autonomy of Auto-GPT still depends on prompts from humans, even after getting an initial suggestion from OpenAI’s models.
Despite developments in artificial intelligence and automation technologies, the study emphasizes the significance of human engagement in coding activities, particularly when it comes to security considerations. According to the paper, AI is not yet capable of replacing coders, and their knowledge and experience are still required to ensure the quality and security of the code.
The sources for this piece include articles in TheRegister.
