Using AI to Inject Vulnerabilities in Python Code

Developing software that is free of vulnerabilities is an ongoing challenge for developers, as their impact may not be apparent until they are exploited. Although security tools can help identify vulnerabilities, their effectiveness is questionable. To address this challenge and assist developers in implementing more secure code, we aim to develop AI-based vulnerability injection techniques. In fact, having code with security flaws is fundamental both for the evaluation of security tools and for training. Our research specifically focuses on building AI models that can detect potential locations in the code for vulnerability injection. To train these models, we created a dataset that includes vulnerable and secure (i.e., patched) versions of Python code collected from open-source repositories. Results show that our methodology successfully identifies potential locations where a vulnerability can be injected with high accuracy. We also compared our approach with the deterministic use of Regular Expressions (RegEx) created based on the vulnerability patches. As a result, our AI approach outperformed the RegEx by a large margin. This paper demonstrates the feasibility of using AI models to identify potential vulnerability injection locations in Python code, thereby paving the way for future research on injecting and exploiting these vulnerabilities with AI. Such research can help in evaluating the effectiveness of security tools and training security teams. This work represents the first step towards our roadmap of using AI to inject vulnerabilities in Python code.