LLMVul: 21,430 LLM-Generated C/C++ Functions Mined From 226 Production Repos, 1,540 Vulnerable Across 17 CWEs

arXiv 2609.10945·medium signalXBlueskyLinkedInCopy link

Existing vulnerability datasets cover human-written code or controlled prompting setups, so nobody could study LLM-generated code as it actually lands in shipped projects. LLMVul mines AI-assisted development from GitHub over four years (2022-11-13 to 2026-09-03) using commit metadata and AI-authorship provenance signals, yielding 21,430 unique deduplicated C/C++ functions from 226 repositories with repository, commit, function, provenance and AI-tool metadata attached. Labels come from an ensemble of static-analysis and pattern-based techniques with CWE categories assigned, validated by independent manual annotation at Cohen's kappa 0.79, producing 1,540 ensemble-vulnerable functions across 17 CWE categories.