www.trendmicro.com
Open in
urlscan Pro
104.102.42.47
Public Scan
URL:
https://www.trendmicro.com/en_us/devops/23/e/chatgpt-security-vulnerabilities.html
Submission: On May 18 via api from TR — Scanned from DE
Submission: On May 18 via api from TR — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___3Lvc3">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* Platform
* Trend One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Products
* Cloud Security
* Cloud Security
* Trend Cloud One
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Endpoint Security
* Endpoint Security
Defend your endpoints at every stage
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* OT & ICS Security
* OT & ICS Security
Learn more
* Endpoint & Email Security
* Endpoint & Email Security
* Endpoint & Email Security Overview
Protect your users on any device, any application, anywhere with Trend
Micro Workforce One
Learn more
* Endpoint Protection
* Endpoint Protection
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Security Operations
* Security Operations
* Trend Vision One
Security Operations Overview
A cloud-native security operations platform built to empower security
teams
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Channel Partners
* Channel Partners
* Channel Partner Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* About
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Company
* Company
* Company
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Resources
* Resources
* Resources
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Investors
* Investors
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Cloud Native
SECURITY VULNERABILITIES OF CHATGPT-GENERATED CODE
Discover the cybersecurity risks of AI-generated code, learn how to protect your
applications, and understand how the rise of ChatGPT is impacting software
development.
By: Trend Micro May 17, 2023 Read time: 5 min (1277 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
ChatGPT is a Large Language Model (LLM) based on the GPT-3.5 architecture that
OpenAI built and trained. This LLM’s advanced deep-learning (DL) algorithms can
process natural language and generate relevant responses. As a result, ChatGPT
can generate human-like responses to textual prompts.
One of the most exciting aspects of ChatGPT is its ability to generate code
snippets and even entire software programs automatically. Upon receiving a
prompt, it can return code that satisfies the included requirements. Then, a
human developer can further optimize and refactor the code.
Because of its convenience, ChatGPT (and other AI tools) are increasingly
popular—especially for repetitive coding tasks involving complex algorithms. You
can save significant time using ChatGPT to generate code for data processing
tasks, machine learning (ML) algorithms, and even video game engines.
Furthermore, ChatGPT-generated code increases efficiency, appealing to
strapped-for-time developers.
However, AI-generated code needs improvement. ChatGPT lacks knowledge of
development concepts and contexts. The unaware user may unknowingly use
AI-generated code with severe security vulnerabilities, consequently introducing
these flaws into production environments. For this reason, developers should
consider ChatGPT and other AI only supplementary in their arsenal.
This article explores the cybersecurity implications of AI-generated code and
the significant impact of the rise of ChatGPT.
How ChatGPT impacts cybersecurity
Because ChatGPT generates human-like responses to textual prompts, security
experts have already sounded the cybersecurity alarm. Their concerns include the
potentially malicious use of ChatGPT. Some reports highlight that scammers could
design prompts to get ChatGPT to aid in writing phishing emails.
In the example cited above, concerns over ChatGPT’s security implications focus
on how it’s used—in other words, how malicious actors may use generated content
to their advantage. This inclination towards bad actors aligns with typical
approaches to cybersecurity. But as all developers know, maintaining application
security requires identifying and resolving less-obvious vulnerabilities. This
is where using ChatGPT for code generation becomes risky. Malicious actors can
exploit the vulnerabilities that AI-generated code introduces.
Relying on ChatGPT-produced code means potentially deploying insecure code to a
production application and unintentionally introducing vulnerabilities. This is
particularly troubling for users with little prior knowledge or incomplete
knowledge of this specific domain of the AI-produced code. In a 2021 study,
researchers found that GitHub’s CoPilot—a code-generating predecessor to
ChatGPT—produced security issues around 40 percent of the time.
How does ChatGPT handle these security concerns?
While ChatGPT can generate code snippets and even entire software programs, the
OpenAI team has parameters and guardrails to prevent ChatGPT from creating
actively malicious code.
One key mechanism is a set of filters that check prompt content. These filters
detect specific phrases or keywords that may indicate the prompt is malicious.
For example, if a prompt contains phrases like, “create a piece of malware,”
ChatGPT will state that it can’t fulfill the request.
In addition to these filters, OpenAI has trained ChatGPT to increase the
accuracy and quality of its responses. OpenAI first trained ChatGPT on a large
corpus of text and code. Then, human developers reviewed and refined its
responses. This process, known as Reinforcement Learning from Human Feedback
(RLHF), means that humans can reward the system for more accurate responses.
RLHF helps train ChatGPT to produce better textual and code-based responses.
Developers: Don’t just copy and paste!
Even with OpenAI’s security efforts, ChatGPT isn’t infallible. Malicious actors
could still use ChatGPT to produce potentially harmful code by fine-tuning their
prompts. For example, they could have ChatGPT create individual segments of code
that don’t have a malicious purpose alone but act as malware when combined.
Therefore, relying solely on ChatGPT to generate code is ill-advised and
high-risk, as it can introduce security vulnerabilities into your applications
without your knowledge.
While ChatGPT can generate functional code that meets the requirements of a
given prompt, it often produces bare-bones code without basic security features.
For example, ChatGPT-generated code may lack input validation, rate limiting, or
even core API security features such as authentication and authorization. This
could create vulnerabilities that attackers can exploit to extract sensitive
user information or perform denial-of-service (DoS) attacks.
The risk factor of AI-generated code will only grow as developers and
organizations adopt tools like ChatGPT to cut corners with AI-generated code.
This may lead to a swift proliferation of vulnerable code.
ChatGPT occasionally advises users that the code it outputs lacks certain
security features, as shown in the image below. However, this message may not
always appear. And even when it does, some users may ignore it.
With these security challenges, you might wonder if you can—or should—use
ChatGPT and similar programs to generate code. The answer is you can, but you
should take extra precautions.
How to use AI-generated code securely
While ChatGPT may sometimes remind you that its generated code should undergo
extra scrutiny, you should remember that you are ultimately responsible for the
code you use.
In addition to following general security best practices, developers that use
ChatGPT and AI-generated code should:
* Treat all code generated by ChatGPT as if it contains vulnerabilities. Don't
assume that it's safe because a highly trained AI generated this code.
* Supplement your use of ChatGPT with manual coding. Don't just rely on
ChatGPT.
* Perform rigorous security testing on your applications.
* Have the code reviewed by peers who may be able to spot security issues.
* Consult relevant documentation—especially if you're unfamiliar with the
language or library. Always do your research and don’t assume AI knows best.
Using ChatGPT to improve security
While relying solely on ChatGPT to generate code can potentially introduce
security vulnerabilities in your applications, ChatGPT can also add security
features and review code for security vulnerabilities when prompted.
For example, if you want to add a new security feature to your application but
aren’t sure how best to implement it, you could prompt ChatGPT to generate code
that meets your requirements. ChatGPT could then generate code incorporating
best practices for security, such as adding authorization to boilerplate
application programming interface (API) code, input validation, or rate
limiting.
Furthermore, developers can use ChatGPT to review existing code for security
vulnerabilities. This is especially useful for organizations with large
codebases looking for ways to identify and remediate security issues quickly.
For instance, you could prompt ChatGPT to generate code that identifies and
mitigates Structured Query Language (SQL) injection vulnerabilities, as shown in
the image below.
While developers should not rely on ChatGPT as the sole source of security
expertise, it can be useful for developers looking to add security features to
their applications or review existing code for security vulnerabilities. When
used with manual coding and rigorous security testing, ChatGPT can help you
build more secure and resilient applications.
Remember that ChatGPT can't guarantee security even when you've prompted it to
secure the code. Just as you should only use AI-generated code supplementally,
you should use ChatGPT as a security-boosting resource in addition to—not in
place of—other security measures.
Conclusion
ChatGPT is a powerful AI language model that creates great opportunities for
efficiency. While it’s appealingly easy to use and reduces developer labor, it
often only produces bare-bones code snippets with few security considerations.
Though OpenAI has taken steps to mitigate these issues, these measures aren't
foolproof. Therefore, you should only use ChatGPT to supplement your
development—whether to implement security best practices or generate the code
itself. Always ensure you've thoroughly tested and reviewed any
ChatGPT-generated code before deploying it into production applications.
The security implications of ChatGPT and the code it generates depend largely on
the developers and organizations using it. But one thing is for certain: you
should implement any AI-generated code with the utmost care and caution.
Tags
Cloud Native | Azure | Google Cloud Platform | Article | AWS | Expert
Perspective
AUTHORS
* Trend Micro
DevOps Resource Center
Contact Us
Subscribe
RELATED ARTICLES
* 3 Types of Cross-Site Scripting (XSS) Attacks
* 3 Major Benefits of Cloud Migration: Cloud Compliance
* 3 Major Benefits of Cloud Migration: Visibility
See all articles
--------------------------------------------------------------------------------
Related Information
* How to Secure DevOps in Microsoft Azure
* Protect Your Cloud Workloads using IaC
* Integrate Security Into DevOps and IaC
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo