ONE YEAR OF USING LLMS FOR APPLICATION SECURITY: WHAT WE LEARNED

Summary from the TLDR InfoSec newsletter

LLMs show promise for finding vulnerabilities due to their potential to understand code behaviors and go beyond the exact pattern matching that is used in traditional SAST tools. LLMs provide inconsistent results, have privacy issues, are time-intensive to train, and their use can lead to vendor lock-in. Many of these issues could be mitigated by modifying their usage. This article lists some possible improvements. CodeLlama, LLaMA, Mixtral, and Mistral are particularly problematic for these tasks.