Security Degradation in Iterative AI Code Generation -- A Systematic Analysis of the Paradox
Not on the map. Why?
Abstract (arXiv)
The rapid adoption of Large Language Models(LLMs) for code generation has transformed software development, yet little attention has been given to how security vulnerabilities evolve through iterative LLM feedback. This paper analyzes security degradation in AI-generated code through a controlled experiment with 400 code samples across 40 rounds of "improvements" using four distinct prompting strategies. Our findings show a 37.6% increase in critical vulnerabilities after just five iterations, with distinct vulnerability patterns emerging across different prompting approaches. This evidence challenges the assumption that iterative LLM refinement improves code security and highlights the essential role of human expertise in the loop. We propose practical guidelines for developers to mitigate these risks, emphasizing the need for robust human validation between LLM iterations to prevent the paradoxical introduction of new security issues during supposedly beneficial code "improvements".
Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Builds on 7 of its 21 references that are in the map. First posted on arXiv 19 May 2025.
Builds on
7 of 21 references.
References · 7
- 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
- 2022Do Users Write More Insecure Code with AI Assistants?cited by 192
- 2024LLM Critics Help Catch LLM Bugscited by 147
- 2022Programming Is Hard -- Or at Least It Used to Be: Educational Opportunities And Challenges of AI Code Generationcited by 99
- 2023Refining ChatGPT-Generated Code: Characterizing and Mitigating Code Quality Issuescited by 79
- 2024Artificial-Intelligence Generated Code Considered Harmful: A Road Map for Secure and High-Quality Code Generationcited by 12
- 2025LLM4CVE: Enabling Iterative Automated Vulnerability Repair with Large Language Modelscited by 9
Built on by
Citing papers per year: 2025: 3; 2026: 7.
10 papers.
- 2025AI Code in the Wild: Measuring Security Risks and Ecosystem Shifts of AI-Generated Code in Modern Softwarecited by 4
- 2025VibeCodeHPC: An Agent-Based Iterative Prompting Auto-Tuner for HPC Code Generation Using LLMscited by 2
- 2026The Kitchen Loop: User-Spec-Driven Development for a Self-Evolving Codebasecited by 1
- 2026Unlocking LLM Code Correction with Iterative Feedback Loopscited by 1
- 2025SoK: Understanding (New) Security Issues Across AI4Code Use Casescited by 0
- 2026Human-Certified Module Repositories for the AI Agecited by 0
- 2026Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fixcited by 0
- 2026The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Repromptingcited by 0
- 2026Vibe Coding and Web Application Security: A Twin-Prompt Studycited by 0
- 2026A Study of the Reliability of Agentic AI-Generated Programscited by 0
- 2026A Study of the Reliability of Agentic AI-Generated Programs16 Sep 2026
- 2026Vibe Coding and Web Application Security: A Twin-Prompt Study21 Aug 2026
- 2026The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting26 Jul 2026
- 2026Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix17 Jun 2026
- 2026Unlocking LLM Code Correction with Iterative Feedback Loops16 Jun 2026
- 2026The Kitchen Loop: User-Spec-Driven Development for a Self-Evolving Codebase26 Mar 2026
- 2026Human-Certified Module Repositories for the AI Age3 Mar 2026
- 2025AI Code in the Wild: Measuring Security Risks and Ecosystem Shifts of AI-Generated Code in Modern Software21 Dec 2025
- 2025SoK: Understanding (New) Security Issues Across AI4Code Use Cases20 Dec 2025
- 2025VibeCodeHPC: An Agent-Based Iterative Prompting Auto-Tuner for HPC Code Generation Using LLMs26 Sep 2025