{"id":"https://openalex.org/W7131781392","doi":"https://doi.org/10.1134/s0361768825700446","title":"State of the Art of the Security of Code Generated by LLMs: A Multivocal Literature Review","display_name":"State of the Art of the Security of Code Generated by LLMs: A Multivocal Literature Review","publication_year":2025,"publication_date":"2025-12-01","ids":{"openalex":"https://openalex.org/W7131781392","doi":"https://doi.org/10.1134/s0361768825700446"},"language":"en","primary_location":{"id":"doi:10.1134/s0361768825700446","is_oa":false,"landing_page_url":"https://doi.org/10.1134/s0361768825700446","pdf_url":null,"source":{"id":"https://openalex.org/S150218641","display_name":"Programming and Computer Software","issn_l":"0361-7688","issn":["0361-7688","1608-3261","3034-5847"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320267","host_organization_name":"Pleiades Publishing","host_organization_lineage":["https://openalex.org/P4310320267","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Pleiades Publishing","Springer Nature"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Programming and Computer Software","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109293036","display_name":"Leonardo Criollo Ram\u00edrez","orcid":null},"institutions":[{"id":"https://openalex.org/I147280213","display_name":"Universidad Veracruzana","ror":"https://ror.org/03efxn362","country_code":"MX","type":"education","lineage":["https://openalex.org/I147280213"]}],"countries":["MX"],"is_corresponding":false,"raw_author_name":"Leonardo Criollo Ram\u00edrez","raw_affiliation_strings":["Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico"],"raw_orcid":"https://orcid.org/0009-0000-0682-9854","affiliations":[{"raw_affiliation_string":"Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico","institution_ids":["https://openalex.org/I147280213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072216056","display_name":"Xavier Lim\u00f3n","orcid":"https://orcid.org/0000-0003-4654-636X"},"institutions":[{"id":"https://openalex.org/I147280213","display_name":"Universidad Veracruzana","ror":"https://ror.org/03efxn362","country_code":"MX","type":"education","lineage":["https://openalex.org/I147280213"]}],"countries":["MX"],"is_corresponding":true,"raw_author_name":"Xavier Lim\u00f3n","raw_affiliation_strings":["Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico"],"raw_orcid":"https://orcid.org/0000-0003-4654-636X","affiliations":[{"raw_affiliation_string":"Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico","institution_ids":["https://openalex.org/I147280213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126967283","display_name":"\u00c1ngel J. S\u00e1nchez-Garc\u00eda","orcid":null},"institutions":[{"id":"https://openalex.org/I147280213","display_name":"Universidad Veracruzana","ror":"https://ror.org/03efxn362","country_code":"MX","type":"education","lineage":["https://openalex.org/I147280213"]}],"countries":["MX"],"is_corresponding":true,"raw_author_name":"\u00c1ngel J. S\u00e1nchez-Garc\u00eda","raw_affiliation_strings":["Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico"],"raw_orcid":"https://orcid.org/0000-0002-2917-2960","affiliations":[{"raw_affiliation_string":"Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico","institution_ids":["https://openalex.org/I147280213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5045327302","display_name":"Juan Carlos P\u00e9rez-Arriaga","orcid":"https://orcid.org/0000-0003-2354-2462"},"institutions":[{"id":"https://openalex.org/I147280213","display_name":"Universidad Veracruzana","ror":"https://ror.org/03efxn362","country_code":"MX","type":"education","lineage":["https://openalex.org/I147280213"]},{"id":"https://openalex.org/I189268942","display_name":"Universidad de Alcal\u00e1","ror":"https://ror.org/04pmn0e78","country_code":"ES","type":"education","lineage":["https://openalex.org/I189268942"]}],"countries":["ES","MX"],"is_corresponding":true,"raw_author_name":"Juan Carlos P\u00e9rez-Arriaga","raw_affiliation_strings":["Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico","Universidad de Alcal\u00e1, Madrid, Espa\u00f1a"],"raw_orcid":"https://orcid.org/0000-0003-2354-2462","affiliations":[{"raw_affiliation_string":"Facultad de Estad\u00edstica e Inform\u00e1tica, Universidad Veracruzana, Veracruz, M\u00e9xico","institution_ids":["https://openalex.org/I147280213"]},{"raw_affiliation_string":"Universidad de Alcal\u00e1, Madrid, Espa\u00f1a","institution_ids":["https://openalex.org/I189268942"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5045327302","https://openalex.org/A5072216056","https://openalex.org/A5126967283"],"corresponding_institution_ids":["https://openalex.org/I147280213","https://openalex.org/I189268942"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.80104387,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"51","issue":"8","first_page":"587","last_page":"604"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T13851","display_name":"Law, AI, and Intellectual Property","score":0.11219999939203262,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T13851","display_name":"Law, AI, and Intellectual Property","score":0.11219999939203262,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13999","display_name":"Digital Rights Management and Security","score":0.056299999356269836,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14484","display_name":"Technology and Data Analysis","score":0.040699999779462814,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.5522000193595886},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5479999780654907},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5113000273704529},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.44909998774528503},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.43149998784065247},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.4124000072479248},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.3950999975204468},{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.385699987411499},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.3813000023365021}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7401000261306763},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.5522000193595886},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5479999780654907},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.5271999835968018},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5113000273704529},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.44909998774528503},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.43149998784065247},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.42980000376701355},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.4124000072479248},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.3950999975204468},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3813000023365021},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.3564999997615814},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3492000102996826},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3472999930381775},{"id":"https://openalex.org/C509989072","wikidata":"https://www.wikidata.org/wiki/Q15188241","display_name":"Model-driven architecture","level":4,"score":0.33559998869895935},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3343000113964081},{"id":"https://openalex.org/C150292731","wikidata":"https://www.wikidata.org/wiki/Q1342704","display_name":"Code review","level":5,"score":0.3212999999523163},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.31929999589920044},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.31060001254081726},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.3005000054836273},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.287200003862381},{"id":"https://openalex.org/C41458344","wikidata":"https://www.wikidata.org/wiki/Q732577","display_name":"Publication","level":2,"score":0.28380000591278076},{"id":"https://openalex.org/C202105479","wikidata":"https://www.wikidata.org/wiki/Q265013","display_name":"Software evolution","level":5,"score":0.2777000069618225},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2687999904155731},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.26739999651908875},{"id":"https://openalex.org/C61904560","wikidata":"https://www.wikidata.org/wiki/Q1148359","display_name":"Grey literature","level":3,"score":0.2671000063419342},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.2540000081062317},{"id":"https://openalex.org/C2777561058","wikidata":"https://www.wikidata.org/wiki/Q2652119","display_name":"Program comprehension","level":4,"score":0.25110000371932983}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1134/s0361768825700446","is_oa":false,"landing_page_url":"https://doi.org/10.1134/s0361768825700446","pdf_url":null,"source":{"id":"https://openalex.org/S150218641","display_name":"Programming and Computer Software","issn_l":"0361-7688","issn":["0361-7688","1608-3261","3034-5847"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320267","host_organization_name":"Pleiades Publishing","host_organization_lineage":["https://openalex.org/P4310320267","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Pleiades Publishing","Springer Nature"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Programming and Computer Software","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6429580450057983,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":63,"referenced_works":["https://openalex.org/W1975675278","https://openalex.org/W2133933998","https://openalex.org/W2612764117","https://openalex.org/W2735864825","https://openalex.org/W3177813494","https://openalex.org/W4213241976","https://openalex.org/W4223574077","https://openalex.org/W4288057765","https://openalex.org/W4288080276","https://openalex.org/W4292956935","https://openalex.org/W4315815628","https://openalex.org/W4318586239","https://openalex.org/W4362659486","https://openalex.org/W4366562575","https://openalex.org/W4384026520","https://openalex.org/W4384026634","https://openalex.org/W4385270018","https://openalex.org/W4385848632","https://openalex.org/W4385944467","https://openalex.org/W4386081297","https://openalex.org/W4387356195","https://openalex.org/W4387869031","https://openalex.org/W4388212271","https://openalex.org/W4388212693","https://openalex.org/W4388483649","https://openalex.org/W4388858772","https://openalex.org/W4389441385","https://openalex.org/W4391158659","https://openalex.org/W4391182712","https://openalex.org/W4391282616","https://openalex.org/W4391377904","https://openalex.org/W4391506183","https://openalex.org/W4391558520","https://openalex.org/W4392353733","https://openalex.org/W4393027333","https://openalex.org/W4393140899","https://openalex.org/W4394591508","https://openalex.org/W4394597036","https://openalex.org/W4395702127","https://openalex.org/W4396790452","https://openalex.org/W4399567378","https://openalex.org/W4399837430","https://openalex.org/W4400315178","https://openalex.org/W4400374531","https://openalex.org/W4400484660","https://openalex.org/W4400680805","https://openalex.org/W4401543590","https://openalex.org/W4401544296","https://openalex.org/W4401990041","https://openalex.org/W4402811603","https://openalex.org/W4402897200","https://openalex.org/W4403747722","https://openalex.org/W4404057519","https://openalex.org/W4404952844","https://openalex.org/W4405522167","https://openalex.org/W4406293345","https://openalex.org/W4406450020","https://openalex.org/W4406959951","https://openalex.org/W4407184937","https://openalex.org/W4407386389","https://openalex.org/W4407806421","https://openalex.org/W4408214684","https://openalex.org/W4408355426"],"related_works":[],"abstract_inverted_index":{"AI-assisted":[0,188],"programming":[1,248],"has":[2,21],"gained":[3],"significant":[4],"traction":[5],"in":[6,13,23,93,171,187,196,234],"recent":[7],"years,":[8],"primarily":[9],"driven":[10],"by":[11,99,138],"advances":[12],"large":[14],"language":[15],"model":[16],"(LLM)":[17],"technologies.":[18],"This":[19,64],"growth":[20],"resulted":[22],"the":[24,35,58,67,72,96,136,203],"development":[25],"of":[26,37,60,75,140,168],"tools":[27,182,232],"such":[28],"as":[29,123,125,215,239],"ChatGPT":[30],"and":[31,103,119,132,142,177,180,231,252],"GitHub":[32],"Copilot.":[33],"However,":[34],"use":[36,246],"AI":[38],"models":[39],"for":[40,184,205,242],"code":[41,49,77,210],"generation":[42,211],"presents":[43],"a":[44,79,88,221],"critical":[45],"challenge:":[46],"The":[47,107,162,227],"generated":[48],"is":[50],"prone":[51],"to":[52,245],"security":[53,73,169,186],"vulnerabilities,":[54,228],"raising":[55],"concerns":[56],"within":[57],"domain":[59],"secure":[61],"software":[62,80,213],"development.":[63],"study":[65,236],"examines":[66],"current":[68],"research":[69,191],"landscape":[70],"on":[71,192],"implications":[74],"LLM-generated":[76,172],"from":[78,155],"engineering":[81],"perspective.":[82],"To":[83],"this":[84,193,235],"end,":[85],"we":[86,150,157],"conducted":[87],"multivocal":[89],"literature":[90,128],"review":[91],"(MLR)":[92],"accordance":[94],"with":[95],"guidelines":[97],"outlined":[98],"Kitchenham":[100],"et":[101,105],"al.":[102,106],"Garousi":[104],"search":[108],"encompassed":[109],"five":[110],"academic":[111],"sources:":[112,129],"IEEE":[113],"Xplore,":[114],"ACM,":[115],"ScienceDirect,":[116],"Springer":[117],"Link,":[118],"Wiley":[120],"Online":[121],"Library;":[122],"well":[124],"two":[126],"grey":[127],"Google":[130],"Scholar":[131],"Google.":[133],"We":[134],"supplemented":[135],"selection":[137],"means":[139],"backward":[141],"forward":[143],"snowballing":[144],"techniques.":[145],"Through":[146],"Quasi-Gold\u2019s":[147],"automated":[148],"search,":[149],"identified":[151,233],"2796":[152],"peer-reviewed":[153],"studies,":[154],"which":[156],"selected":[158],"48":[159],"primary":[160],"studies.":[161],"analysis":[163],"revealed":[164],"seven":[165],"distinct":[166],"categories":[167],"vulnerabilities":[170,219],"code,":[173],"six":[174],"mitigation":[175,229],"strategies":[176],"best":[178],"practices,":[179],"four":[181],"recommended":[183],"improving":[185],"coding.":[189],"While":[190],"issue":[194],"remains":[195],"its":[197],"early":[198],"stages,":[199],"initial":[200],"findings":[201],"highlight":[202],"need":[204],"caution":[206],"when":[207],"integrating":[208],"AI-powered":[209],"into":[212],"development,":[214],"it":[216],"may":[217],"introduce":[218],"at":[220],"higher":[222],"rate":[223],"than":[224],"human-written":[225],"code.":[226],"strategies,":[230],"can":[237],"serve":[238],"valuable":[240],"resources":[241],"developers":[243],"seeking":[244],"LLM-based":[247],"assistants":[249],"more":[250],"securely":[251],"responsibly.":[253]},"counts_by_year":[],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2026-02-27T00:00:00"}