Search papers, labs, and topics across Lattice.
This study critically assesses the security of authentication code generated by five leading AI coding assistants using a bi-modal framework of static code analysis and dynamic penetration testing aligned with NIST SP 800-63B guidelines. It reveals that while single-shot prompts can enhance compliance, they are insufficient for ensuring robust security, as generated code often lacks essential protections against threats like brute-force attacks and inadequate session management. The authors advocate for iterative reprompting as a necessary strategy to enforce a self-auditing process, ultimately concluding that current AI coding tools do not guarantee secure-by-default applications, necessitating a shift towards continuous verification in enterprise settings.
Iterative reprompting is essential for AI coding assistants to generate truly secure authentication code, as single-shot prompts fail to provide adequate protections.
Large Language Models (LLMs) are increasingly integrated into software development workflows, yet their ability to autonomously generate secure authentication code remains uncertain. This paper evaluates the security architecture of authentication systems generated by five prominent AI coding assistants through a bi-modal assessment framework combining static code analysis and dynamic penetration testing, mapped to NIST SP 800-63B guidelines. The study examines model behavior across four prompting strategies Basic, Secure, NIST-Based, and Reprompting to reflect varying levels of developer guidance. Empirical results demonstrate that code generated from functional or generically secure prompts consistently omits critical protections, particularly concerning brute-force resistance, session management, and robust password handling. While providing explicit, single-shot NIST context significantly improves compliance, the findings reveal that this remains structurally inadequate. Instead, iterative Reprompting: forcing models into a contextual self-auditing loop is strictly required to achieve a comprehensive, defense-in-depth security architecture. Ultimately, this study proves that current AI coding assistants do not produce secure-by-default applications, dictating that enterprise deployments must transition from single-shot prompt engineering to continuous, standards-driven verification pipelines.
