AI Coding Assistants: Securing Generated Code with Rules Files

AI Security LLM Code Rules

The blog post discusses the security risks associated with Large Language Models (LLMs) in coding, particularly in the context of "Vibe Coding" where coders rely heavily on AI for code generation. The post highlights that while LLMs can generate insecure code, the risk is higher with Vibe Coding due to the lack of developer involvement in the code generation process.

Security vulnerabilities in AI-generated code are prevalent, with studies showing that 25% to 70% of working coding outputs from leading models contain vulnerabilities. Common vulnerabilities include Code Injection, OS Command Injection, Integer Overflow or Wraparound, Missing Authentication for Critical Function, and Unrestricted File Upload.

The post suggests several ways to improve the security of AI-generated code. Traditional software security tooling like SAST, SCA, and secrets scanning still has a role to play. The emergence of AI-Assisted Programming increases the importance of shifting such scans left, into the IDE. PR time scanning and remediation continues to be crucial.

AI coding assistants have introduced a new capability to exert leverage on application security: Rules Files. These are standard guidance that developers can provide to AI coding assistants to establish project, company, or developer-specific context, preferences, or workflows. Rules files can be used to significantly reduce the number of vulnerabilities in AI-generated code by crafting clear, concise, and actionable instructions tailored to a particular programming language.

The post also announces the open-sourcing of a set of baseline secure rules files to help unstick the blank page problem. These rules were created with the help of Gemini, using a prompt that encodes security guidance. The rules are available for a set of common languages and frameworks, and are compatible with several popular AI coding assistants and tools.

Secure AI Vibe Coding with Rules Files

Large Language Models (LLMs) are good at coding, powering AI-assisted programming tools like GitHub Copilot, AI IDEs, and IDE extensions. This democratizes some elements of development, giving birth to Vibe Coding, where you "forget that the code even exists." However, not all AI-assisted coding is vibe coding, and security risk emerges as developers are removed from the details of generated code.

LLMs Generate Insecure Code, Vibe Coders Moreso

It's clear that AI-generated code is not secure by default. Based on research, somewhere between 25% and 70% of working coding outputs from leading models contain vulnerabilities. Vibe coding increases this risk even more, with users given an AI assistant often producing more vulnerable code due to excessive confidence in the generated code.

Traditional software security tooling still has merit in securing code, with tools like SAST, SCA, and secrets scanning all having a role to play. The emergence of AI-assisted programming increases the importance of shifting such scans left, into the IDE. PR time scanning and remediation continue to be crucial, and the creation and adoption of secure by default frameworks and libraries can also reduce risk.

Where AI coding assistants have brought with them one new capability to exert leverage on application security is through:

Rules Files

Rules files are an emerging pattern to allow you to provide standard guidance to AI coding assistants. You can use these rules to establish project, company, or developer-specific context, preferences, or workflows. Most popular AI coding tools offer rules, including:

  • GitHub Copilot: Repository Custom Instructions
  • Codex: AGENTS.md
  • Aider: Conventions
  • Cline: Custom Instructions
  • Claude: CLAUDE.md
  • Cursor: Rules
  • Windsurf: Rules

Rules Files for Security

Research consistently finds that crafted prompts can significantly reduce the number of vulnerabilities in AI-generated code. Rules files offer an ideal method to centralize and standardize these security-focused prompting improvements. To methodically craft a rules file for security:

  • Craft instructions that are clear, concise, and actionable
  • Tailor rules to their relevant scope, such as a particular programming language
  • Break down complex guidelines into smaller, atomic, and composable rules
  • Keep the overall rules concise; under 500 lines

The following are common vulnerabilities in AI-generated code:

  • CWE-94 (Code Injection)
  • CWE-78 (OS Command Injection)
  • CWE-190 (Integer Overflow or Wraparound)
  • CWE-306 (Missing Authentication for Critical Function)
  • CWE-434 (Unrestricted File Upload)

Open-Sourcing Secure Rules Files

Rules files have yet to see broad adoption for security use cases. However, to help unstick the blank page problem, we're open-sourcing a set of baseline secure rules files. These rules were created with the help of Gemini, using a prompt that encodes the guidance outlined above. Check out the open-source rules files over on GitHub!

References

Tags

  • #Research
  • #Security
  • #AI
Read original article

Related Articles

Compare Brand Ranking Across LLMS with LLMConsole

Tools • LLM, Comparison, BrandRanking, AI, Recommendation

Intelligent Terminal with AI Tools & Modern UX

Tools • AI, ML, Python, Turbo, CLI

Create Stunning Content with Hedra Studio's AI Tools

Tools • AI, Generative, Multimodal, Content, Studio