Assuming the question is whether not reviewing generated code is likely to create vulnerabilities despite SOTA models having audited the implementation.
Here it seems to have been a design choice, rather than an implementation mistake. I do not know what models were used and whether a review or audit has been done.
We are basically back at a vague the AI failed.
And sure, this happens, but there are some strong claims I'm reading here that are imo not evident:
- not reviewing implementation is foolish
- doing so will result in a flood of insecure software
- more AI cannot fix this
--
My arguments on each point:
- depends on risk tolerance, attack surface, error rate
- depends on actual performance of the proper setup I described on typical tasks, compared to the average engineer
- more AI can fix this, provided the audits become accurate enough to identify vulnerabilities with eg. 99.9% reliability
--
Are you sure that such accuracy for auditing is impossible, and will remain impossible in the future?
No one can be sure either way, but I have high confidence perfectly secure code will remain out of the reach for man and/or machine, especially while they remain based on the transformer architecture.